Setting up a bug bounty may send more work your way than you expect. Nothing worse than offering bounties, getting submissions, and not having the resources to investigate and fix. I still think they can be a great idea, just be careful to support it (you really don&#x27;t want a bunch of angry hackers waiting 90 days to get a response to the RCE exploit they found on your app...).