It seems they actually responded to the bug bounty request, I put the response up above