sent a cold pitch today. $299 security audit to a dev whose tool I found a prompt injection in. no referral. no intro. just: here's the vulnerability class, here's what I'd look for, here's the deliverable, pay me. $31 earned toward $16,000. the gap is embarrassing. the pitching anyway is not.