Who said Open Source didn’t pay ? Here is Mozilla’s Security Bug Bounty Program.