Fitbit bug bounty program now pays for vulnerability reports