Bug bounties seem simple: a flaw finder spots a vulnerability, responsibly discloses it, and then gets a reward for their ...