What is the ruling on working and on financial contracts in digital vulnerability discovery platforms that include conditions such as priority of reporting and delayed payment?

This transaction is permissible in Sharia and falls under the category of ju'alah (reward for a service). The evidence for its permissibility is the Almighty Allah's saying: "And for him who brings it [there shall be] a camel's load; and I am responsible for it" (Quran 12:72). Consequently, whoever performs the action for which the reward is specified, after being informed of it, is entitled to that reward. There is no harm in this transaction unless it constitutes assistance in something forbidden, such as if the website publishes forbidden content. The variation in the value of the reward based on the type of vulnerability discovered, or the fact that the reward is due to the first person to report the vulnerability, does not affect its permissibility.