My bank runs a public bug bounty program. It's a start