It was also comprised of two separate $3,000 rewards. Maybe they treated it as two vulnerabilities?
In this case the second $3000 bounty was due to a 2x promotion at the time. The guideline for a critical is $3000, but Cloudflare does occasionally award bonuses for severe vulnerabilities (e.g. https://hackerone.com/reports/1478633).
6k seems to be a really low payout given the potential impact (particularly with respect to personal data), the work needed to discover such vulnerabilities, the revenue of cloudflare and the potential money that could be made by a blackhead. Or am I naive?
Likely impacted by the fact that this was in a private beta and not a publicly available product. Betas are “supposed to” have bugs.
A well-run bug bounty should encourage early reporting of issues. Should he have waited until public release so the impact was bigger?
It's a moot point because this hasn't happened. Cloudflare didn't lower the payout because it was in beta.
Yeah I didn't realize CF's payouts were so low.
A "private" beta enforced solely by a clientside check, notably.
Sure, but the client-side check completely limits the exposure Cloudflare have because big enterprise corporates don't get themselves into a private beta by playing with client-side checks. Only a few companies were using this feature at the time.