Add yourself to the https://hackerone.com/directory/programs, that's free afaik. You won't get the 'managed' badge. And have a bug-bounty page on your website. There are specialized search engines looking for those. Add a https://securitytxt.org/ if you haven't already.

I know a startup listed there and they get regularly approached by security researchers. Some only run generic test suites, e.g. port scans, if signing up with unicode usernames causes errors, cross-side scripting, but it will still be valuable. And a cross-side scripting bug has bounties of 100 USD or less.

Via a recent Show HN submission I got a security scan by https://www.cybersenshi.com/ which I think was comprehensive.