When I was in college, I once found some bad exploits in the sims social on Facebook, the subsidiary (Playfish?) behind it asked me for my address and which console I owned and then unexpectedly sent me a huge number of games and goodies. It was great. Better than money, I think (I sold some of those games anyway).

I reached out to employees via unofficial channels. I'm sure if I had spoken to some exec I'd be in jail right now.