You can reward a bounty through any report submitted to HackerOne.
- Open the report you'd like to award a bounty for.
- Expand the drop down at the bottom of the report, above the comment box.
- Select “Set award” from the drop-down menu and fill in the amount you wish to reward.
Bounty amounts can be increased at any point by setting another award on the report, but, since HackerOne ensures that the hacker is paid quickly, bounties cannot be removed once awarded.
In terms of timing, some teams prefer to reward a bounty once the issue has been confirmed as valid, while others wait until the issue is resolved. Take a look at this HackerOne blog for more discussion about when to reward.