bug bounty earnings