Thank you for the radical candor everyone (I greatly appreciate it)!
While I'm humbled by the warnings, I'm also inspired by the encouragement.
Consulting, quality assurance, and security bounties are all related to my passion, but as I've clarified in other comments: investigating and fixing known bugs is the niche I'd like to aim for, regardless of the non-technical challenges in procuring such work.
> Are you familiar with the concepts of SDET (software development engineer in test) or software test/QA?
I am familiar with the concepts, but I'd classify that as more about putting measures in place to prevent bugs from being deployed, rather than identifying and fixing their root causes.
Thanks for the suggestion. While I am interested in security (and value its importance), my passion lies with finding and fixing known bugs, not finding unknown bugs.
Instead of trying to make brute force more costly, couldn't these services make it impossible, by forcing the fulfilment of a CAPTCHA when trying to expand/follow a shortened URL?
I notice you said "almost impossible". Do you (or anyone else) know how to get it reversed?