New study shows that bug bounties without a secure application development program and testing can be costly.