As an idea: crowdsourced bug bounties. If software companies aren't willing to offer sensible incentives, corporations (who often have far more money at stake)

As an idea: crowdsourced bug bounties. If software companies aren't willing to offer sensible incentives, corporations (who often have far more money at stake) should fill in the gaps. If someone built a platform to allow e-commerce/finance/other web companies to (collectively) fund a $500,000 bug bounty for an exploitable bug in an SSL library/Linux/Android/STM32/whatever project they rely on for security, it might encourage many more white hat hackers to pen-test the platform...