What would an appropriate payout be? I mean, the classification ("high exploit probability, abuse-related impact") seems about right to me. Are you saying tha

What would an appropriate payout be? I mean, the classification ("high exploit probability, abuse-related impact") seems about right to me. Are you saying that abuse bugs should be more valuable? That all bugs should pay more? That this is a rich company so they should pay more? > If they poked around a bit more they may have found a better GAIA->Email vulnerability They still can! Report more bugs, get more bounties. I don't see how this is related to how much they paid for this one. > A database of emails for every major youtube channel would be worth an awful lot. It's pretty clear from the article that you can't use this API to scrape at that kind of volume. This kind of thing was never in the offering. As the title says, you can leak "any" email, not "every" email.