4 ms·

If he worked a week and didn't find a vuln, he'd get 0. Average that in. Bug bounties are the uberification of security research.