1.

Serious vulnerabilities occurring in the production environment

2.

Vulnerabilities that can cause a loss of user funds/assets remotely

3.

Privilege Escalation

4.

Code/SQL Injection

5.

Cross-Site Request Forgery (CSRF)

6.

Cross-Site Scripting (XSS)

7.

Remote Code Execution

8.

Privilege Escalation

9.

Authentication Bypass

Theoretical vulnerabilities without POC

Any Dos/DDoS activities

Invalid or missing SPF records (incomplete or missing SPF/DKIM/DMARC)

Clickjacking/UI with minimal security impact

Phishing

Tab-nabbing

Content spoofing

Cache-control related issues

Exposure of internal IP address or domains

Vulnerabilities affecting outdated or unpatched browsers.

Bugs already known or already reported by someone else (reward goes to first reporter).

Issues that aren't reproducible.

Email/SMS bomb

Testing on other users accounts

Automated testing using tools such as scanners

Excessive request attempts that affects the availability of our services to all users

Destruction of data

Disrupt of services