Researchers: Flaw auctions would improve security