I am not going to do anything malicious with the vulnerability and I will responsibly disclose it. However, I am in a humanities PhD with very low earning potential after I graduate and, right now, I have no real income as a student (apart from minimum wage on campus employment).
Is it just me or is it unreasonable for a SaaS to expect responsible disclosure without compensating me?
I would take this disclosure (depending on what it is and how it impacts) and use it to market yourself and further your industry credibility.
If it's a big impact I think some sort of bounty is great, but you can use it as a pivot point to encourage them to build a program.
From your perspective I would imagine that exploring the vulnerability, packaging and capturing the steps-to-reproduce are all work. Work should be paid for.
In summary, I don't think they can make demands of your time and effort by requiring you to package and share. But don't let it sound like a you have anything they have a right to or that you're holding anything hostage.