“At $35,000, it’s also the highest bounty I’ve received so far from HackerOne (and I believe the highest GitHub has paid out to date).”
A high school junior with nothing to do during lockdown chained a CRLF injection into GitHub’s private pages auth flow. GitHub paid $35,000 for it. That is cheap next to what the bug was worth to someone who wanted into private org sites. A bounty program is the cheapest security team a company will ever hire.