Bug Bounties are generally a good thing and I am particularly encouraged by Google’s approach in requiring the bugs be turned over as they are found.  Bug hoarding is a serious problem as is leaving bugs in play versus letting remediation start immediately.

https://threatpost.com/google-project-zero-prize-pays-200000-for-critical-vulnerability-chains/120569/