Are bug bounty programs common in open source? All the big ones off the top of my head are for production systems. Granted the bug may be in an open source piec

Are bug bounty programs common in open source? All the big ones off the top of my head are for production systems. Granted the bug may be in an open source piece of a deployed system. Seems a very bold move to offer this for source code that's freely available. I like it.