Penetration tests vs. bug bounty programs – comparison