A framework to assess bug-bounty platforms based on potential attack vectors