Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant

Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant risk, I'm not sure what is. [1] https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...