bug bounty limitations