daniels blog posts on the issue from last year are a good look into this. they keep getting reports of serious issues that, when prodded, point out code that’s not even in the project. but there are some actual hits in there that they do fix. these all seem to come from large teams of pros that check the ai output beforehand, so they have no need for the bounties.