[dfeojm-zlib]

Heck, you should try to give interviewees real bugs so they're solving real problems (not to exploit them but to see how they think and work) instead of theoretical chalkboard problems or standard brainteasters.

Certainly, guide them towards easy-ish bugs rather than complicated ones right away, because there is something to risk management of new people attacking gradually-increasingly critical code / difficult bugs. Of course you probably wouldn't give a random interviewee root access to a credit card processing system, but you should ratchet-up the level of trust incrementally as fast and as frequent as a staff member has proven themselves (treat people as adults, not kids).