At the asterisk devcon there was discussion of bug bounties. This lead to Josh updating the wiki at https://wiki.asterisk.org/wiki/display/AST/Asterisk+Bug+Bounties
Note most of that content was already there but they added a “bounty” tag to Jira (the bug tracker).
I wonder if that would be worth wild for FreePBX.
Same dynamics/policies as mentioned on the Asterisk wiki. If there is a bug you need fixed offer a bounty as mentioned and people can pick it up and fix it (following submission/PR guidelines).