I've had a good experience doing a couple of bug fix bounties for urllib3 https://github.com/urllib3/urllib3/issues . I'd be interested in how the maintainers how found running the bug bounty and if it's given them more useful fixes or if it just adds more noise to deal with