The large amounts you read about by big companies can hardly be matched my small companies. And rarely reflects the damage it could cause. Our maximum amount is US$1000 currently. We (https://opencagedata.com/security-bounty) get regular reports where high or critical severity is claimed but maybe that's only to get our attention. No report so far justified the full amount. We learned what is much appreciated is fast payout.
https://docs.hackerone.com/programs/bounty-tables.html
The large amounts you read about by big companies can hardly be matched my small companies. And rarely reflects the damage it could cause. Our maximum amount is US$1000 currently. We (https://opencagedata.com/security-bounty) get regular reports where high or critical severity is claimed but maybe that's only to get our attention. No report so far justified the full amount. We learned what is much appreciated is fast payout.
In https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties... you see 'full account takeover' listed as US$300 and 'Critical issues on [redacted] (database credentials, entire application source code leaked and SQLi)' at US$800.