After finding a vulnerability in a program, one can submit it to a bounty program, such as ZDI. According to ZDI's website, they will examine the vulnerability and possibly offers a bounty. If the researcher does not accept the offer, they promise not to use the vulnerability information. However, I guess some people might not completely trust the bounty program and would like to provide limited information in their submission.
My question is, what is the general practice for providing information to/negotiate with a bounty program? I am thinking about providing software version, OS version, general description of the vulnerability and some proof, such as the info at crash and analyze results by tools like !exploitable Crash Analyzer. However, although the bounty program such as ZDI encourages the researcher to submit a PoC, the PoC will basically disclose the vulnerability entirely. Thus, the PoC will not be included at least in the initial submission.
Please provide your answers and comments regarding this issue. Thank you!