As a maintainer of several OSS projects, I could work full time on them and have time for nothing else. Yet, I'm pretty sure that even if these projects would be 100x more popular, the donations I would receive wouldn't even pay my daily expenses.

I refuse all donations/tips for three reasons:

- as per above, your donation is generally insignificant. it's just overhead in tax accounting

- people donate "with strings attached": AKA "here's $2, but I'd really love this feature"

- receiving donations wouldn't be fair to any current or past contributors that made the projects what it is

The last point is especially true in the OSS landscape. The most front-facing programs get the donations, but the low-level libraries and infrastructure that make them possible get nothing. Heck, I've seen forks with a few superficial tweaks receiving donations and reaping the benefits while the original projects is chugging along slowly at the hard-to-build infrastructure that nobody else wants to do.

Bug bounty sites fall almost universally in the last category in my eyes.