My current plan is to set up a HackerOne page. I know that bug bounties don't replace good penetration testing, but it's a start.