Isn't this the wrong way to go about securing a system? It's better than nothing I suppose, but black hats aren't going to tell you when they've found a vulnerability. On the flip side, there's no guarantee that the right set of folks are looking at the system (thankfully, that doesn't seem to be the case here).
If you are explicitly putting out a system for tests, you aren't only attracting black hats. (Actually you will discourage black hats, since they don't want to show their methods when they are of no use.)
