thumbnail Google paid $12 million in bug bounties last year to security researchers