“We cannot be creative because it violates security!”
So your product team has decided to do a Bug Bounty program (BBP)?