It's also a terrible security practice to advertise. Getting a remote code execution bug in to production would only entail building a free feature for the comp

It's also a terrible security practice to advertise. Getting a remote code execution bug in to production would only entail building a free feature for the company and getting it past a trivial code review during an interview you could subsequently turn down!