Can Bug Bounty Programs Replace In-House Testing?