It's one of the first bug bounty programs by a major hospitality brand.