I tend to agree. LastPass is literally in the business of securing passwords, and was giving them away. I think the bounty should be: 10000 < bounty <= 100,000

I tend to agree. LastPass is literally in the business of securing passwords, and was giving them away. I think the bounty should be: 10000 < bounty <= 100,000 This bug would have been exploited, sooner or later, and would have had massively disastrous results. Those results are now avoided, and that's worth a lot more than 1k.