We have posted an update to the policy that may affect rewards received for reports that you submit. Please re-read the policy and check the latest changes.
The most notable change is copied here for easy reading:
For each report, please allow Oath sufficient time to patch other host instances. If you find the same bug on a **different** (unique) host, prior to the report reaching a `triaged` state, file it within the existing report to receive an additional 10% bonus (per host, not domain). Any reports filed separately *while we are actively working to resolve the issue* will be treated as a `duplicate`.