You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes.

Unless you’re talking about private exploit sales, which is totally different.

Found some data about this: https://www.hackerone.com/press-release/six-hackers-break-bu...

As of that date, 6 people made over $1M total since it launched (not per year). So maybe 1 or 2 have hit 500k in a year? Some of those names have been doing it for over 6 years.

According to a previous report, only 0.3% have made over $5k in their lifetime on the platform.

https://duo.com/decipher/taking-hype-out-of-bug-bounty-progr...

There are numerous Synack Red Team member millionaires too. The first in hacker history was an SRT member in mid-2018, but didn't want publicity. - Rajesh Krishnan, Synack

It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months.

And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is.

We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)