usually you may report a bug and hope to get some short of reward for your white hat action on the matter. However that is strictly voluntary for the site, so no guarantee. Another way to go about it is try to reach a deal with the site, still risky unless you get a third party escrow into the matter. Ideally casinos should have a permanent bug-hunting programme altogether, but... no easy way for this despite looking quite obvious they should.