Please do not take it the wrong way, but investing your time and resources into a bounty program is nothing different than investing financially in a project / ICO. As many lost "something" to scams or shitty projects within a bounty program, a lot of other lost money too. So it's all about evaluating a project and a team no matter how you invest in a possible "future reward".