[throwaway52123]

It's all marketing. I would ignore it and move on with your life.

Allowing and encouraging responsible disclosure is never a bad idea. That said, if you're a young startup, I would focus on practicing and promoting good security hygiene within your company. Secure coding best practices, locking down infrastructure, that kind of thing. I wouldn't overcomplicate it or stress too much unless your product needs special security attention (i.e. you are a bank or likely to be hacked by a nation state or something). If you're the only technical person and you're already doing this, it does not sound like you have much (anything?) to worry about outside of the norm.

I hope that can help you sleep better at night :-D