Security audit can be expensive depends on size and app complexity. From what I saw, it starts from $3k

I think it's better to make a 1 page to put details scope, rewards, etc. Here is good example https://bugbounty.linecorp.com/en/