If I can give you an advice I would opt for zero bounties as did Holo who got a good result despite the project being little known during the ICO. I would like to mention another project only because you have already talked about it in here, otherwise I would not have done it. I followed Holo for the entire ICO period and I assure you that there were no rewards for anyone, no bonus, no bounties, nothing at all and same ICO price for all. I believe that such behavior gives an extremely serious representation of the project and we have a great need of such projects lately. We can not get more than bazaars ... 
I assume that if someone would come to Holo who after finding a kind of critical vulnerability they would have some funds in reserve to reward such person. While it differs from bounty program it's essentially a bounty. This is what I meant opting for an amount for bounties. Not a bounty program per se, as in such case I share your (and others) view.
