I think this is more related to vulnerabilities. Let's say you find a bug with their implementation of a feature that doesn't involve a security issue ( or a vuln ) you won't get paid. Don't quote me on that !
Get notified when there are additional replies to this discussion.