I need to find time to blog this, but TL;DR we've gotten *insane* value for the dollar out of our public vulnerability bug bounty program, so much so that it has completely changed my mind on the matter