Bug bounties pay researchers for disclosed vulnerabilities. Learn scopes, severity tiers, safe harbor and how to read program quality.