They pay security researchers for finding vulnerabilities in any GitHub repository and maintainers for fixing them.