I don't know. I think you could perhaps align incentives such that any bounty claimed via the government program is competitive, public, and companies are ranke

I don't know. I think you could perhaps align incentives such that any bounty claimed via the government program is competitive, public, and companies are ranked by the number and severity of bounties. Then the company would have an incentive to run a bounty program where they had a chance of controlling the narrative a bit.