Open source projects rarely have a budget for development, let alone bug bounties.