"Nice catch " then denied bug bounty for flaw it still hasn't fixed