The key to these "bug bounty" companies is sort of a two pronged approach.

Make money white hat (b2b) And blackhat (inside info i unfortunately cannot expose)