We opened our bug bounty last August expecting a flood of low-severity noise. We got the noise — and also three findings that genuinely changed how we build.
This is an honest accounting: what we paid out, how long triage actually took versus what we promised, and the internal process changes that came out of it.
The most valuable report was not the most severe one. It was a researcher patiently explaining that our password reset flow leaked account existence through timing — something we had reasoned about in design and then quietly broke in a refactor eighteen months later.