Note: Verizon Media is now known as Yahoo.
We have posted an update to the policy that may affect rewards received for reports that you submit. Please re-read the policy and check the latest changes.
The most notable change is copied here for easy reading:
For each report, please allow Oath sufficient time to patch other host instances. If you find the same bug on a different (unique) host, prior to the report reaching a triaged state, file it within the existing report to receive an additional 10% bonus (per host, not domain). Any reports filed separately while we are actively working to resolve the issue will be treated as a duplicate.