Software companies of late pay developers to find bugs in their security. Read more here: http://blog.codinghorror.com