I think it&#x27;s a neat idea, but I&#x27;m not a fan of their proposed bidding structure. Specifically, I think they will have problems with under-bidding and then abandonment. If lowest-bidder is based on some government requirement though, it&#x27;s funny to see such a forward-looking system continuing to be constrained by the same broken rule-set.<p>The prototypical bug bounty in an open source project is to assign an award based on the perceived value of the code, and then open it up to submissions, while providing a central place for anyone to post about their working on a solution, their progress, etc. People are encouraged to communicate openly about their progress, and any new entrants can decide based on that chatter if they should work on it, or assume someone else will claim the bounty.<p>The only job for the person awarding the bounty is clear acceptance criteria, and  public feedback on submissions. Then there are potentially issues with split bounties if multiple people end up contributing to the final result. Again, awards are at the determination of the offerer, but generally I think it&#x27;s best if they don&#x27;t directly control&#x2F;assign the work.