@dzucconi => Lunching a Security Bug Bounty Program at Artsy.

This is a pass at a security bug bounty program blog post. I am sure I forgot things and maybe some things I shouldn't talk about :)

There're some links here to force-public that were made from force, what's the process for updating force-public? 
I amended the whole paragraph like this:

A less evident step was to have a conversation with the finance department about paying bounty via Paypal to individuals that often live in countries that may have U.S. sanctions imposed on them (see [What countries do I need to worry about in terms of U.S. sanctions?](http://www.treasury.gov/resource-center/faqs/Sanctions/Pages/answer.aspx)). We also needed to talk about the terms under which such payments could be made at all - we now require the individual's full name and postal address. Other bounties, including [Github's](https://bounty.github.com/), require a [W9](http://www.irs.gov/pub/irs-pdf/fw9.pdf) for U.S. citizens or a [W8_BEN](http://www.irs.gov/pub/irs-pdf/fw8ben.pdf) for non-U.S. citizens before any payment can be made.