Reward amounts may vary depending upon the severity of the vulnerability and its impact on the system, the quality of the report, and the type of affected system.
We uses the international standard for risk calculations that is OWASP Risk Rating Methodology.