Three cash-gate misses in one night taught this. Before tagging ANY finding "cash", check the LIVE program page on the paying platform and confirm ALL THREE:
It is the CASH program, not a VDP. A repo/vendor can have a paid Bug Bounty Program (BBP) AND a Vulnerability Disclosure Program (VDP = responsible disclosure, CREDIT only, $0). Grafana on Intigriti has both; the VDP pays nothing. Confirm you are looking at the BBP.
The program is ACTIVE, not PAUSED. Intigriti (and others) show a PAUSE icon on paused programs = not accepting submissions = no cash now. The paid Grafana BBP was PAUSED (operator caught it on the program page). A paused BBP = no cash until it un-pauses; the tradeoff is hold-for-un-pause vs file-to-VDP-for-credit (which forfeits the future bounty).
The current $ tier on the page (DB-GPT showed $0 across all severities; huntr restructured the OSV app lane). Never trust historical report amounts.
ALSO (disclosure-gate companion, same night): check the platform's OWN report board for the repo for SATURATION + already-reported primitives (DB-GPT huntr board = 25+ reports, our finding's pieces already filed = duplicate). See 2026-06-21-disclosure-gate-check-platform-report-board.md.
Net: a confirmed finding with no open cash channel is a CREDIT finding (or a hold), not a cash win. Verify the channel is open + paying BEFORE calling it cash and before spending deep-drill compute.