"From a $ perspective, most bug bounty programs look rather uneconomic to me, which I presume is by design." It depends. If you're a graduate with multiple FAA

"From a $ perspective, most bug bounty programs look rather uneconomic to me, which I presume is by design." It depends. If you're a graduate with multiple FAANG offers in the US, they're not worth it. If you're in a developing country, they're worth it a lot. Unfortunately, that also means that people who have good skills are less likely to participate and people who don't have marketable skills have an apparent incentive to try (they will not get the money, but the promise/possibility still lures them to submit reports) resulting in an absolutely atrocious quality of reports. I don't think authentication is useful for white hats. A whitehat can just report it (which he'd do anyways) and then either get the bounty or not. The only benefit of authentication would be for the receiving company, and that's called triage and exists as a service (as we see in the full timeline, it was used here).