Any bug bounty program that isn’t part of the source control repo website (GitHub/Lab…) Will not enjoy the deserved exposure for such a program, but, the day that GitHub realize this - they will want a cut of that deal