How to run an internal security incentive program without it getting gamed, and what OpenAI's Hugging Face incident shows about rewards bending under pressure.