Bug bounty programs pay you for the severity of the exploit, not the potential damage you could do with it. The researcher found an unpatched server with a known Ruby RCE and cracked a weak password. Whether he found the server empty or containing nuclear codes isn't what determines the payout.
Storing user data and private keys on your computer after reporting the hack and using them again to access the systems is way beyond the scope of a bug bounty program (and probably criminal).
Re:Instagram's Million Dollar Bug (2015)
by MaxBarraclough on Monday December 14, 2020 @06:54PM
(#25425099)
> the severity of the exploit, not the potential damage you could do with it
Isn't severity measured in terms of potential damage?
Re:Instagram's Million Dollar Bug (2015)
by WalterGR on Monday December 14, 2020 @06:59PM
(#25425143)
Yes.
https://www.facebook.com/BugBounty/posts/approaching-the-10t...
CDN bug report... Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our CDN... a very sophisticated attacker could have escalated to remote code execution. As we always do, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty — $80,000.
FTA: "specifically I gained access to a lot of data including SSL certs, source code, photos, etc"
Blackhats typically find that there is little market for their info, especially before the advent of bitcoin being popular.
And now?