Hacker News Reader

How would price discovery work to "correctly price bugs"

What is a bugs correct price? The price that a bad actor would pay for it?

Some value between the cost of not fixing it and the value of exploiting it

We have CVSS scores for grading vulnerabilities. So that could be useful as a start.

CVSS is pretty useless for categorizing severity.