The author did not mention if they were rewarded by the bug bounty program. A vulnerability of this severity surely requires a reward of some sort.
Does anyone have any more information about whether or not this person was compensated for their work?