You can report any post you want, it doesn't mean it will be accepted though.

OP, definitely give an update on whether you've received the bounty.
Without disclosing the vulnerability of course