The model.

Companies invite researchers to find bugs and pay per valid, in-scope report. You're paid for impact, proven and reproducible — not for scanning. Platforms (HackerOne, Bugcrowd, Intigriti…) mediate scope, reports and payouts.