Currently most of dev bounty platforms do start with OSS, but we only started doing that last year.

Because of that, 90% of users of our commercial usage today is still close-source, and biggest customer base are from heavily regulated industries like insurance, finance, and even commercial banking, with 2 of them having > $15B each under management.

Now, as you pointed out, we had to implement and background checks, audit logs and have direct full-time relationship with devs through our subsidiaries.

But what made the biggest difference was our security tooling like GitSlice, which along with dev environments cuts down majority of risk exposure.

I would be really curious why you think something like this wont work for private repos?