I dropped 5x RCEs in a single report, it got triaged, then after 16 days the customer patched everything and rewarded it as P3? So a potential $10k–15k critical report suddenly became a $500 payout in one comment - this severity decision genuinely makes no sense . These kinds of decisions genuinely discourage researchers from hunting on platforms/programs. Spending days finding impactful vulnerabilities, writing detailed reports, and helping secure production systems only to see the severity heavily downgraded afterward is extremely demotivating. In this case, the issues were valid, triaged, and even patched by the customer, which clearly proves the impact was real. Yet the final outcome made it feel like all the effort put into the research had little value. Researchers invest huge amounts of time and energy into finding critical vulnerabilities responsibly, and inconsistent severity decisions like this make people lose trust in the process. Honestly, one comment was enough to completely kill the motivation and energy I had for #bugbounty
