Idk, to me your mindset seems mad. There are bad actors in the world we all know that. So if you ran a online company and I was your customer I should expect th

Idk, to me your mindset seems mad. There are bad actors in the world we all know that. So if you ran a online company and I was your customer I should expect that no one will attack your company because it is illegal? And you would not take steps to protect your company because attacking it would be illegal? Saying out loud sounds crazy. There is no legality when there person stealing my data may be in Russia, or China, or India, who may be an individual, an organized crime ring or state actor. The internet does not care about your legality. So by offering a bug bounty program you are at least showing some interest in the white hat people not working to screw you over when in many circumstances it would probably be much more profitable for the bugs to be exploited or sold. Why would you want to send this type of person to prison?