@n1xnx @LukaszOlejnik

I think you could probably get away with charging $20 or more. Make them actually think about hitting that submit button. Anyone who's spent hours of their valuable time researching a real security issue won't be deterred by $20, but someone who's just thrown something together will definitely think twice, and you can always refund people if their reports are actually worthwhile.