Hacker News Reader

No, their bug bounty only extends to iOS.

Doesn't mean you can't email product-security@apple.com with your bug anyway.

Why, if they clearly place no [monetary] value on security of OSX?

I suggest contact Google's Project Zero. I think those guys would love to help you...