Not hugely different but seems easier on my brain to instead set up an “account deposit” or something. Put $5 in to register your account. * If you have a rep

Not hugely different but seems easier on my brain to instead set up an “account deposit” or something. Put $5 in to register your account. * If you have a report validated as “not junk” (not “a valid vulnerability”, just “not spam / good faith”) we send it back and your account is whitelisted. * If you submit a junk report your account is closed and we keep it. * If your account hits 30/60 days with no submissions, we refund and close it for inactivity. The extra charge per submission seems largely unnecessary. If someone signs up and creates two dozen spam reports, just close their account and all their reports. How well this would work would largely, I imagine, hinge on the success rate of these guys. If they’re sending in 100 reports to get a single $1000 bounty, then there’s still a positive ROI if your time is cheap enough. At least requiring a unique payment method for each attempt would cut down on repeat offenders.