HackerOne has an open source program which is free. You could start with it: https://www.hackerone.com/company/open-source-community

I'm sure you can talk to them then, and figure out the best strategy to offer paid rewards.