> so there is no easy solution that makes the "I ran a tool, gimme $100" people go-away without causing a much bigger problem to now exist.
Maybe consider setting up a free-tier HackerOne bounty program? I think they triage to some degree on your behalf.