In bug bounty programs you pay security researchers to attack your site so they can find and tell you about potential risks.