There’s a market rate for vulnerabilities in highly trafficked websites. If you want people to give you the bug report instead of selling it to zero-day gangs or governments then you need to pay the market rate. You can expect a small discount because selling the bug to you is ‘doing the right thing’, but if you’re not paying more than a tee and you want to attract the people that go out of their way to discover issues then you’re automatically on the back foot.