3) I am not sure that they will be able to deliver on their promise to distribute the coins to bounty hunters, since they might fail to reach the specified hard cap. I am not saying that they are scams. Here's what I'm saying:
Not all projects are scams, i think some just don't generate enough interest because people don't see real world use or maybe they have terrible marketing skills. But there's certainly a possibility their ICO won't be fully funded then they will not be able to distribute tokens for the bounties which essentially means a lot of wasted time for everyone.
If it makes sense to you, then how do I move from here to mitigating the risks down to the lowest level?
Obviously you don't have any control over whether the project will be successful or not but considering if you've only invested your time vs actually money, imo you won't have as much to loose if the project goes belly up and they're not able to pay all the investors back.