Invest into having a functional process to receive and handle security reports, and having the appropriate information published first. That's way more important than having an account with some bounty platform.

And bounty platforms aren't a security audit. If you want an audit, buy an audit by someone who gets access to your code and can review your internal setup.