I don&#x27;t know much about this which is why I asked.<p>It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all rce bugs should be paid out on an assumption that if used they&#x27;ll lead to access to a shell or to user data.