Solution: put bug in, get accomplice to claim bug bounty under an alias.
(This is fraud, don't actually do this! But it comes up every time someone does bug fixing metrics)
(This is fraud, don't actually do this! But it comes up every time someone does bug fixing metrics)
Edit: If it's not a bug bounty to fix it, but a vuln bounty to sell it, then it's highly-unethical but not necessarily illegal.