Facebook, Mozilla, Google, and lots of other companies encourage this with exploit bounty programs.