Interesting terms, if you can't talk about it afterwards how do people know that any of these bounties were paid out? After all there is a pretty simple loophole here: mark any and all reports as duplicates, no need to pay out.
You can't talk about the details of the bug but you can talk about the reward: https://twitter.com/Stephen/status/627190837735239680 The program is legit, they are just very slow (I didn't actually receive the miles until October).