Setting up a bug bounty may send more work your way than you expect. Nothing worse than offering bounties, getting submissions, and not having the resources to investigate and fix. I still think they can be a great idea, just be careful to support it (you really don't want a bunch of angry hackers waiting 90 days to get a response to the RCE exploit they found on your app...).