johoe says he got a reasonable reward.

You should report any vulnerability here, it will at least get you known and may get you contract with other firms.