A flood of vulnerability reports is starting to kill off bug bounty programs.