My take on bug bounties is that they're good for Mickey Mouse exploits, but if you find a really good exploit it'll probably pay you more to exploit it than to submit a bug report for a bounty.