> The trick is agreeing on a fair price. In the end you're paying for the information and the secrecy. So probably it should be a per day fee until the bug is fixed and a lump sum at the end.
How you could agree on the price without knowing the details about the issue e.g. is it even real?