6 must-haves for fed bug bounty programs