That’s how we handle it with ours as well. He found a way around a certain control and we opened a bug report with the vendor and it was acknowledged and fixed. He then realized he locked out other kids with that and laughed and tries to find more worth reporting.

Is that black hat or white hat?