How do things like bugcrowd (and bug bounties in general) work from a legal point of view? It seems very risky to go poking around without some kind of formal contract with the target.