Application vendors or organizations run a bug bounty program that allows for security researchers or bug bounty hunters to scout for security vulnerabilities in their application/software.