Comment by jliptzin

If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.