Quantifying the value of bug bounty programs for cybersecurity