the security as identity vs security as outcome split rings true. where do bug bounty programs