The kinds of assignments involved with GPZ also shy away from server-side applications ran by other companies.

Maybe doing approved bug-bounty research in a competitors webapp is a safer proposition.