> In my experience, people submitting vulnerabilities to bug bounties tend to incorrectly estimate in the other direction, since they have financial incentive to do so.
A good point. There's definitely motivation to exaggerate the impact.
However, could there be a flip side to this as well?
People not reporting vulnerabilities they consider minor, thinking they'll get no financial gain. No money or fame, so why bother?
Some of those unreported issues could be very critical when connected with something else minor or perhaps even something that's not a bug at all.
Perhaps some of bug bounty funds should be retained for awarding any reported issues that turned out to be a (part of) critical vulnerability in the future?
Retroactively awarding issues that became more critical later on should encourage reporting of maximum number of bugs. Even those the discoverer considered insignificant.
As a result, everyone involved would be better of. More bugs would get reported and their discoverers properly compensated.
> ... minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they're critical.
Wouldn't you agree it's preferable they're reported regardless, no matter how minor they may be? For example unintended version disclosure could very well make targeted attack a successful one. Account enumeration disclosure could conceivably be used to attack the account holder in some other way, including social engineering attacks.