first bug bounty program paid