[kds3]

> The recipient is the one who needs to pay income tax

That's only in some countries like US. There are many HackerOne bug hunters from e.g. Russia where your company is responsible for paying all taxes including employee income tax.