&gt; In my experience, people submitting vulnerabilities to bug bounties tend to incorrectly estimate in the other direction, since they have financial incentive to do so.<p>A good point. There&#x27;s definitely motivation to exaggerate the impact.<p>However, could there be a flip side to this as well?<p>People <i>not</i> reporting vulnerabilities <i>they</i> consider minor, thinking they&#x27;ll get no financial gain. No money or fame, so why bother?<p>Some of those unreported issues could be very critical when connected with something else minor or perhaps even something that&#x27;s not a bug at all.<p>Perhaps some of bug bounty funds should be retained for awarding any reported issues that turned out to be a (part of) critical vulnerability in the future?<p>Retroactively awarding issues that became more critical later on should encourage reporting of <i>maximum</i> number of bugs. Even those the discoverer considered insignificant.<p>As a result, everyone involved would be better of. More bugs would get reported and their discoverers properly compensated.<p>&gt; ... minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they&#x27;re critical.<p>Wouldn&#x27;t you agree it&#x27;s preferable they&#x27;re reported regardless, no matter how minor they may be? For example unintended version disclosure could very well make targeted attack a successful one. Account enumeration disclosure could conceivably be used to attack the account holder in some other way, including social engineering attacks.