I think most people don't realize that UA is a part of the Star Alliance, and you can redeem amazing seats/suites on their partner airlines, ie Lufthansa, Singapore Airlines, Turkish Airlines, Thai Airways and Air Canada.

But this far cheaper for United than offering cash rewards.

It's far cheaper, especially since miles are so hard to redeem. United has so few seats per plane for miles users that they are nearly worthless. I have hundreds of thousands of miles on United and can rarely ever use them for a flight I want unless I am willing to make 4 or 5 hops.

The lions share of bug bounty reporters are from overseas.

I can't even remember a single submission from an American in the bounty I'm involved with.

So in conclusion: if you limit yourself to just that audience, and tempt them with only miles, most americans who are competent enough to obtain bug bounty rewards are making enough money that miles is kind of a dubious incentive. So sure- you save money, but you get fewer submissions, and you get less return on investment than a bounty that pays out.

BUT you get the great publicity of being one of the forward thinking companies that does bug bounties. Anecdotally many non-programmer people are starting to understand that bug bounty = good.

You can redeem with Star Alliance, which serves 193 countries (i.e., almost everywhere).