You have a point, I wasn’t expecting a bounty at all. I believe they valued the additional proposed attack vectors, the detailed report and highliting a number of issues that could be fixed to hardening the service. I found that Google values researches and reports beyonf RCEs
