Looking for bugs in computer code can be lucrative but there’s more to security than just cashing in.