Trust is definitely the main concern.

The company's reputation could be leveraged in this process. If the bounty is clearly defined with specific milestones and KPIs, that might be sufficient.

To manage participation, a whitelist can be implemented. This means that anyone wanting to take part in a specific bounty must be approved by the bounty organizer. Additionally, the number of whitelisted participants working on a bounty can be publicly displayed.

The bounty itself should be complex enough to deter mercenary developers while incentivizing high-quality contributors.