In reply to David Anderson.

Hi David

Fair question.

In reality, the payouts are not done per vulnerability. That's because the plugin developers themselves don't pay for bounties (as many are completely open-source without cashflow). Instead, we have a monthly prize-pool which we pay out every single month (you can take it as a fund, which we put together with our partners) to those devs/ethical hackers who give back to the ecosystem and help identify security vulnerabilities in plugins and themes.