What we learned running a public bug bounty for a year Ninety-one reports, eleven that mattered, and one that we should have caught in code review.