No guarantee you'll get a bounty from a small project. You're more likely to get paid if you exploit it.