The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.
Once you reach a certain bar, people do the right thing.
$40k isn't enough to cover the cost of research+reporting at livable salaries, let along overhead, fake starts, etc.
1) Microsoft could afford $10M
2) I think people would be honest well short of $10M
3) The cost to customers, if this went public, would be far more than $10M.
You want people to be able to make an honest living on security research, or otherwise, the only people looking for vulnerabilities, aside from the independently wealthy hobbyists, will be crooks.
The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
Knowledge required to find stuff like that is very scarse. And you have to know where to look for.
Chances to find something really big are so small that its not worth it to look for them finnancially.
Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee.
TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
1. Disclose to Microsoft for $40k
2. Disclose to an intelligence agency for several times that
3. Disclose to criminals for several times that, in turn
The incentives are now publicly known to be misaligned, and as a potential Azure customer, I have to contend with the simple reality that a significant number of vulnerabilities will be exploited rather than reported.
$40k doesn't even come close to covering engineer time here. This should be a $1M payout.