why company pay million to hackers if the find any bug in their website?