ZDI claims they'll pay for bugs in serverside software, which is a different meaning of the term "serverside" than I'm using (admittedly, that definition is more precise). An nginx bug has a half-life once discovered. A Youtube bug does not.

I'm a little skeptical of published prices for serverside software, though. Do you know anyone who specializes in selling those bugs? I don't.