I remember being 17. I was spectacularly bad at evaluating risks. You're right - a lot of people who want to file bug bounties overestimate how much marginal o

I remember being 17. I was spectacularly bad at evaluating risks. You're right - a lot of people who want to file bug bounties overestimate how much marginal ones are worth. At the same time, this scenario suggests to me that bug bounties aren't currently doing a good job of incentivizing people away from attempting to monetize significant exploits and towards more responsible security practices. If we have to depend on the risk analyses of teenagers, we may be in trouble. Which is to say I suspect we have both problems.