Bug/vulnerability bounties are a pretty good way to getting results, especially for those hard to figure out ones that deal with a specific issue. Otherwise, there's a much bigger incentive to sell the vulnerability to someone else, or use it for nefarious reasons.