“Rewards were paid out for 845 vulnerabilities, more than a quarter of which were rated ‘critical severity’ or ‘high severity’.”
More than 5,600 researchers filed nearly 8,000 reports with Netflix since 2016. The total payout is just over $1 million. That works out to under $200 per researcher. Over 200 of the paid bugs were critical or high severity. Netflix bought eight years of security testing for the price of a rounding error.