Here is another perspective: I have been making money through bug bounties for the past 5 years (I'm a researcher on the major bug bounty sites and multiple p

Here is another perspective: I have been making money through bug bounties for the past 5 years (I'm a researcher on the major bug bounty sites and multiple private ones). More times than I can count, I have found major, non-low effort bugs, and the company will spend time deflecting, and I just won't end up getting paid. Luckily, this is less than 10% of the valid bugs I've found. I've learned to just move on after a certain point. This behavior from these companies nearly made me quit 2 years ago. I was so frustrated that I completely stopped for 6 months. I found 50 bugs in a week for one major company and they spend 2 months trying to tell me that they don't own the site anymore, and weren't going to pay me. It was in scope at the time I found the bugs. These weren't just minor bugs either. It allowed me to break into all private rooms on the service in multiple ways, get access to back-end network settings, and even takeover accounts. I pushed back and they were in violation of their SLA. I got a nice payout a few weeks later.