You might not make a million dollars, but hackers are making good money from reporting vulnerabilities.