This should be required reading for anyone submitting vulnerabilities to bug bounties.
In my experience, people submitting vulnerabilities to bug bounties tend to incorrectly estimate in the other direction, since they have financial incentive to do so.
You replied to a comment indicating that even minor bugs can be serious -- which they can -- but many researchers will find actually minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they're critical.
There's a balance there, and it can be tough to find. In any event, my stance is that if there's a security bug, you should damn well fix it :)
A good point. There's definitely motivation to exaggerate the impact.
However, could there be a flip side to this as well?
People not reporting vulnerabilities they consider minor, thinking they'll get no financial gain. No money or fame, so why bother?
Some of those unreported issues could be very critical when connected with something else minor or perhaps even something that's not a bug at all.
Perhaps some of bug bounty funds should be retained for awarding any reported issues that turned out to be a (part of) critical vulnerability in the future?
Retroactively awarding issues that became more critical later on should encourage reporting of maximum number of bugs. Even those the discoverer considered insignificant.
As a result, everyone involved would be better of. More bugs would get reported and their discoverers properly compensated.
> ... minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they're critical.
Wouldn't you agree it's preferable they're reported regardless, no matter how minor they may be? For example unintended version disclosure could very well make targeted attack a successful one. Account enumeration disclosure could conceivably be used to attack the account holder in some other way, including social engineering attacks.
This applies to all parties- the ones who are vulnerable and the ones who are discovering.
I totally agree with your statement about reporters inflating the impact of minor bugs. In fact, it is the spirit of arrogance which they exhibit that attracted me to OP's comment!