Make it worthwhile for someone to test how 'secure' this system is before touting that title.

An audit or a bounty with no limitations on rendering the system insecure. An example of how not to do this would be the Telegram contest sham.