This is a strong perhaps. It is obviously dangerous to try to estimate a lower bound for negative publicity related to security, but it is also less obviously d

This is a strong perhaps. It is obviously dangerous to try to estimate a lower bound for negative publicity related to security, but it is also less obviously dangerous to refrain from estimating an upper bound (or at least attempting to do so). It is fiscally irresponsible to invest too little in security or too much in security. Software security is a nonalgorithmic problem, and the best you can do is risk management. Look at it this way: if you spent 300 engineering hours a month investigating spurious reports and the only valid reports you ever received were for cross-site request forgery attacks on non-sensitive profile actions, it does not matter what the ivory tower ideal of the bug bounty was, you wasted resources. "Given enough eyeballs, all bugs are shallow" is like the worst case scenario for an algorithm. Sure, it works, but at what cost? What if you had an internal team penetration testing everything and a private bug bounty program? What if you exclusively outsource to NCC Group or Accuvant? There is no hard absolute in this. It's generally good to have a bug bounty program, but you really need to be aware of the numbers. For example, Yahoo actually reduced the payments they were giving in bounties for the same vulnerabilities at the same severity because they did not anticipate how many would be found of that type.