I think people who find bugs and security improvements are rare, and hence should any one find one on any campaign the brand or campaign manager will  value him or her and will have to find ways to reward them. It would be very unfortunate if I'd get no reward at all for that and believe any serious bounty brand will give a very good reward for search a great work done. However the outcome may be, i would notify them, because exploiting bugs to earn money is very bad.