Depends. In the UK we just wait for the minister in charge to resign. That's cheaper than a bug bounty :)