Per CfB:
On the 3rd of January the source code of basic features will be published for peer review. BCNext decided to make it more interesting to do a review, so the code will contain 3 security flaws - serious, critical and fatal ones. The 1st person who reports one of these flaws in a special thread will get a reward (1'000, 10'000 and 100'000 NXT accordingly). There will be SHA256 hashes of flaw descriptions published, the descriptions will be revealed after the flaws r reported. If some unreported ones left after 3 months, BCNext may decide to reveal them at any time.
PS: This has a nice side-effect, copycats have to wait for full disclosure or do their own research.
See https://bitcointalk.org/index.php?topic=345619.msg3918820#msg3918820