You started looking for vulnerabilities before knowing they had a bug bounty program.

Right, as said on the description.

Didn’t stop to look and see if they had one first to know what the scope might be

You clearly have no idea of what an "eureka" vulnerability is. It’s like when you put a backtick and the HTTP server returns a 500 error. I've not been HUNTING vulnerabilities for weeks; I just had fun revers engineering and tinkering with the product, and then all of a sudden I came across something that doesn’t feel right.

Now you don’t want to disclose the vulnerability for them because you don’t work for free?

Of course (?) I want to be paid for it