4 ms·

> whatever you think is fair Please give us some examples of what you would consider fair in this situation.

• tpxl 6y ago
  Hours worked for the exploit * 50$ should be enough.
  • IncRnd 6y ago
    The researcher would probably get paid even less, if that is the case. The value of an exploit has nothing to do with the development time.
  • bawolff 6y ago
    That's silly. If someone spends 100 hours coming up with, say a clickjacking vuln, it does not magically make it worth $5000. If someone spends 6 minutes coming up with zero-click sandbox bypass in chrome, its not just worth $5. Severity matters not time, especially in a bug bounty. If you want the stability (and assurance) of actually getting paid reasonsbly and consistently for this you should get a job as a pentester.
  • rubber_duck 6y ago
    That's kind bad - first of all 50$ can be really low depending on the region, but more importantly this disregards the time spend on looking for exploits that don't pan out. So I would multiply that 50$ by at least 4. But still like the other said bugs should pay by severity not by time spent.