[fowkswe]

Why don't you just pay him for the service he provided you? Is your bounty that high that you can't afford to?

It seems the negative publicity you are getting is going to cost you more..

[jdbernard]

It seems reasonable to assume that they will pay him:

To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided [...] We will also retroactively check to see if other reports found issues that fall into this category.