> A bug bounty program, you’re inviting the entire world to attack your site. And by the way, you you’re not obviously using production, right, you’re spinning up a clone that has no customer data. And it’s not even connected to your network.

> Also, pen tests rarely perform lateral movements across your app, right? .... Whereas a bug bounty, those people can continue to move and infiltrate your network and give you a string of attacks that they were able to finally polling your data,

So I may have misunderstood (or the transcribing is wrong) but the person says you should give bug bounty hunters an isolated non-production instance and yet wants "lateral movement" ? Sounds a bit incoherent.