Assetnote's security research team writes about bug bounty findings, SSRF chains, and vulnerabilities in cloud and web platforms.
HN commenters list it among favorite web application security blogs; it is also linked in bug bounty discussions.
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list):
- https://blog.orange.tw/
- https://ngailong.wordpress.com/
- https://whitton.io/
- https://sakurity.com/blog
- https://homakov.blogspot.com/
- https://buer.haus/
- https://philippeharewood.com/
- https://portswigger.net/research
- https://gerbenjavado.com/
- https://medium.com/@intideceukelaire
- https://samcurry.net/
- https://stephensclafani.com/
- https://www.josipfranjkovic.com/
- https://www.arneswinnen.net/
- https://blog.assetnote.io/
- https://medium.com/@alex.birsan
- https://cablej.io/
- https://jonbottarini.com/
- https://www.corben.io/
There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference.
Shameless plug: I write about web application security at https://edoverflow.com/.
https://docs.hackerone.com/programs/bounty-tables.html
The large amounts you read about by big companies can hardly be matched my small companies. And rarely reflects the damage it could cause. Our maximum amount is US$1000 currently. We (https://opencagedata.com/security-bounty) get regular reports where high or critical severity is claimed but maybe that's only to get our attention. No report so far justified the full amount. We learned what is much appreciated is fast payout.
In https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties-for-four-years/ you see 'full account takeover' listed as US$300 and 'Critical issues on [redacted] (database credentials, entire application source code leaked and SQLi)' at US$800.