No need to implant new bugs. Having access to the source code is enough to spot bugs. Instead of reporting them to your internal Jira, you sell it on $website.

No need to implant new bugs. Having access to the source code is enough to spot bugs. Instead of reporting them to your internal Jira, you sell it on $website. The buyer can fetch the bounty and will be left with a margin.