Immunefi
The largest Web3 bug bounty platform. Critical findings sometimes pay hundreds of thousands of dollars.
immunefi.com →Code4rena
Competitive audit contests. You audit, you submit, you are paid based on validated findings.
code4rena.com →Responsible disclosure
Report through the project's official program. Include a clear write-up and, where the scope allows, a proof of concept on a fork or testnet. Never use a finding against a live contract you do not own.