The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill.<p>And I say this from personal experience. Two years ago I submitted a bug to a $10B+ public company which revealed the personal information (email, name, home address, phone) of ~145M users and they offered $10k. Another recent example to a $50B+ public company via HackerOne that exposed the same sort of data for ~77M users. They paid out $1k. I assumed they had left off a 0, but nope, they actually told me $1k was higher than their normal bounty due to the severity. Submitted a bug to a publicly traded food delivery company in the UK, which revealed detail order history (customer name, address, email, phone, partial CC #) for their entire platform. They offered me £500 in food delivery credit. All of my submissions have been purely in good faith and nothing at all resembling extortion, but I assure you there are thousands of bad actors out there far more skilled than I.<p>And there's plenty of legal outlets for this information (depending on how it is accessed of course). Local governments and Lyft would love to know ridership usage details about Uber.