Even if you don't have the budget for a cash bounty, offering up some amount of free swag (e.g. t-shirts) is a cheap but effective way of attracting researchers. Great example of this is CloudFlare's bounty which is a pretty cool t-shirt and a 1 year subscription.