The crowdsourced security model has been embraced by organizations running public bug bounty programs. These programs are intended to discover and resolve vulns in production applications, but they can unexpectedly deviate from being an effective part of the security development lifecycle into a source of noise. This presentation questions what role such programs have in improving security and what pitfalls they pose for security budgets. It covers strategies for keeping a bounty program focused on positive contributions to development and avoiding the traps that make it a distraction.