A decade ago I got the cops called on me for kindly telling an Estonian company about a vulnerability on their site. Let's find out if that's still a thing in 2026. In this talk I will cover a handful of vulnerabilities I reported to various Estonian companies, how they reacted, and perhaps even what bounties they paid out.