You should give people something for finding vulnerabilities in your site so they actually have a reason to tell you.