[gnu8]

There should be a database of these bounty programs that can tell you if a company pays or not, sort of like a credit bureau.

[alexkus]

https://bugcrowd.com/list-of-bug-bounty-programs