Ask HN: When is the right time to start a bug bounty program?

I'm involved with several bootstrapped companies. Although I'm a veteran developer and familiar with some security best practices, I'm not a security expert by any means.

Bug bounties seem like an increasingly common way to ensure the security of a platform. My question is this: Is it ever too early to start a bug bounty program? Will I invite unwanted attention? Should I first be considering hiring a security researcher directly? (How could I ever afford one?) Will I get any benefit from putting my tiny projects up on HackerOne or BugCrowd?