The following things make a good bounty program.

A good bounty program should 

1. Be a private program that is easier to scale, plus the signal-to-noise ratio of bad bug reports is significantly lower.

2. Be an incentive program.

3. Be best attractive to the hackers.

4. Be as transparent as possible which offers ample guidelines, and clearly communicates what hackers can expect to happen after they submit a vulnerability report.

5. Be a strong communicator. Make communicating with hackers a top priority. To avoid any confusion or unrealistic expectations with them, ensure that your program is as transparent as possible, offers ample guidelines, and clearly communicates what hackers can expect to happen after they submit a vulnerability report.

6. Hire the best. Recruitment of best hackers as employees or contractors.