We do sometimes pay for bug reports relating to the website/services if they meet the conditions here:
construct.net/en/security-policy
This is specifically for vulnerability reporting though, typically not applicable to Construct 3. For Construct 3 bugs, we do not offer rewards.