I recently discovered a major security vulnerability (SQL injection) in one of my companies projects in my free time. I'm working there as a developer, not as a security researcher, but after developing a lot of stuff, you know where to search for vulnerabilities :)
As it is a big company, I'm not actually working on the vulnerable project and no one I know is.
To report the vulnerability, I used the "responsible disclosure" program open to the public. It basically is a way to report a vulnerability, give them reasonable time for them to fix it and get recognized for it. I'm not aware of any other processes inside the company to report vulnerabilities.
I was however surprised to find that employees are excluded from the "responsible disclosure program" in terms of reward (ie. being listed on the disclosure program website as a contributor and/or getting monetary compensation)
On the one hand, there might be conflicts of interest. Employees working on projects might add security vulnerability on purpose to later claim the reward or conspire with coworkers to do so. And it's probably in the best interest of the employee to report security issues as these might affect the reputation of the company and in the worst case may even cost his job.
On the other hand, it doesn't matter where the employee is working if the vulnerability is spotted while being off clock. Rewards might encourage employees to search for vulnerabilities off-clock which benefits the company by removing security issues and only paying for the research if actual issues are found. Employees might also rather look for security issues at other companies that do reward findings.
I'm not complaining about the fact that I wasn't rewarded. I enjoy searching for security issues and it was fun enough already and my work is great. But I'm trying to understand the reasoning behind this policy and if this is usual in the industry.