$40k in bug bounties in 120 days seems pretty good! I always wondered if someone could make a living off of bug bounties.
The total amount was just under $80,000 in 120 days. The table reflects payouts for bugs I was able to disclose, there are a fair few bugs worth >7k that I wasn't able to include in that table. Some platforms/programs explicitly asked not to be listed there.
Do you think your frequency is somewhat maintainable? I myself dream about working full time with bug hunting but have only gotten to a point where I report a few bugs on a hobby basis. To me it feels weird skipping my consultant salary for small payments and sometimes even a "good job dude, here's a t-shirt".
In addition to that, I work full time and participating in bug bounties was/is purely a part time endeavor of mine. Perhaps if I worked full time on bounties I could keep up. Not entirely sure how it would work out, but it would be a risky journey at first nonetheless.
Don't forget that 120days for normal people is
actually 120 business days, or 40 weeks...
120 business days / 5 days per week == 24 weeks
I'm ready to adopt my final form.
Plenty of very good security researchers make less, for any of the reasons I just implied and many others. $80k-$90k is roughly the threshold where I'd say that if you're talented and have a track record, you're needlessly underpaid.
On the other hand: $150k as consulting returns sounds a little on the low side. At 80% utilization (hard, but possible, to maintain) and a reasonable bill rate, you might expect to gross somewhere north of $250k.
For specialist talent, this all goes out the window, of course.
Being able to sit at home (or wherever), have no boss, no schedule commitments, and no constraints on my dress, no need to be social / politic sounds pretty sweet to me.