Why don't you just pay him for the service he provided you? Is your bounty that high that you can't afford to?
It seems the negative publicity you are getting is going to cost you more..
It seems the negative publicity you are getting is going to cost you more..
To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided [...] We will also retroactively check to see if other reports found issues that fall into this category.