I report a lot of bugs and I am not a fan of hacker one or bugcrowd. I also triage bugs through h1 sometimes at work and I really don't enjoy the quality of bugs or the platform.

If you are a smallish company my advice is to have a security page and a specific security contact with a corresponding gpg key, offer smallish reward, and respond quickly. 100 is plenty, even though a lot of people will disagree with me and it's way way better than most.