Fifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get paid that much for an audit of the project (and they didn't hire one, this just one bug report)
Yes. The parent-parent said "It seems to me another zero on the end would be appropriate. "
Perhaps one day I'll learn to read. Sorry 'bout that.
$15k sounds about on the money for the consulting project to assess pam-ussh. But I agree that it's a silly amount for a bounty.
The public release of the report (where the bounty hunter talks extensively about the right and wrong ways to fix the issue) is a nice feather to put in your cap, even if the cash is not a lot.