I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!
But presumably different people look after the security side of things.
A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409
That's not the same at all as their bug bounty program, which is generally one of the best out there.
When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report.
Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.
Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css.
http://aster.or.jp/conference/icst2017/program/jmicco-keynot...