Not having a bug bounty program is a recipe for disaster that could have easily been avoided.

Most bounties pay out extremely small amounts too so it’s not exactly extortionate.