Incentives and Outcomes in Bug Bounties
The study analyzed Google’s Vulnerability Rewards Program after a reward increase in July 2024. It found that this incentive change significantly increased the reporting of high-value bugs, particularly Tier 0 and High Merit submissions. This increase was driven by veteran researchers focusing on high-value targets and new researchers becoming highly productive.