The public launch of Cloudflare's bug bounty program

"We’ve seen that immediately paying researchers led to a huge improvement in satisfaction compared to waiting weeks or months for a T-shirt." lol, what incredible insight.

They only barely glossed over it, but I'm keen on finding out the lift that was required for reproducing their paid services in a sandbox the way they did for CumulusFire.

Would that be significantly more complex than just setting up a random website, and making an account with the services enabled billed to themselves?

Yes, hence my question, because in many cases an environment like this would be sandboxed away so that a researcher doesn't accidentally break anything in production.

Bounty scale surprises me a lot.

I always thought that the main incentive of any bug bounty program is to make it more attractive for any severe 0-day to not get onto black market and instead be compensated fairly by the company.

Isn't $3,000 per Critical just a tiny bit too low for a service that proxies half the Internet?

Don't worry, until a week ago people got a silly t-shirt for reporting a bug to Cloudflare! So clearly this is an improvement.