I hear this refrain often, and it is of course never followed up with a solution.
What would you suggest, a bounty calculated via a multiple of company stock price?
I think its pretty obvious the solution to "not paid enough money" is "pay more money"
How should the price be discovered.
while (recipient_is_unhappy_with_amount)
{
amount *= 3.14;
}
That’s an effective way for recipients to always be “unhappy” with the bounty.
How should their happiness be ascertained? Their word?
Offer them a job.
If you don’t like how much they pay, maybe don’t brand yourself a “security researcher” and then try to earn the equivalent of full-time pay by finding bugs in other peoples products and blogging about it?