Running a security bounty program as a bootstrapped business: lessons learned | Hacker News Reader