<i>&gt; This should be required reading for anyone submitting vulnerabilities to bug bounties.</i><p>In my experience, people submitting vulnerabilities to bug bounties tend to incorrectly estimate in the <i>other</i> direction, since they have financial incentive to do so.<p>You replied to a comment indicating that even minor bugs can be serious -- which they can -- but many researchers will find <i>actually</i> minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they&#x27;re critical.<p>There&#x27;s a balance there, and it can be tough to find. In any event, my stance is that if there&#x27;s a security bug, you should damn well fix it :)