Ok, so here&#x27;s the thing. Your $2500 payout was not commensurate with the severity of the bug. It ought to have been more. A LOT more.<p>You&#x27;re basically telling bounty hunters to not go any further to &quot;prove&quot; the severity of the bug because you&#x27;re saying, &quot;Trust us. We&#x27;ll measure the maximum impact and reward you fairly&quot;<p>And yet, you&#x27;re not being fair at all. So the bounty hunter needs to &quot;prove&quot; the severity of the bug for you. You&#x27;re digging your own grave here by not acting in good faith. The next guy who finds a good bug is not going to disclose it to you - he&#x27;s going to sell it on the black market for a few hundreds of thousands. Or millions.