Bug bounty programs should reject submissions derived from unauthorized malware attacks