Pay the white-hats first.

A project locks ETH for anyone who finds a bug in its contract. Hunters prove when they found it with a hash on chain and send the details privately. The pool stays locked until its date, so it cannot vanish the day a report arrives.