This question already has an answer here:
Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here.
At the moment SE has a security contact page which details how to contact SE regarding security issues, but doesn't detail what actions are acceptable / unacceptable by a researcher when looking for potential security holes in SE sites.
The advantage of having a defined programme is that SE would likely get reports from security researchers who find possible security issues. Without a definition of what action is allowed / forbidden, many researchers won't risk probing a site for fear of legal issues.
Whilst this has been raised before on Meta.SE, I thought it was worth mentioning again as at the moment, the lack of defined guidance on acceptable actions likely means that SE is losing out valid contributions.
On the point of rewards that was raised on the previous question, most programmes have criteria for what is (not) considered a valid finding and these can be used to avoid "T-Shirt seekers".
If administrative overhead is considered an issue, using 3rd party services like Bugcrowd may help with that.