Almost all other companies would say the bug was out of scope, thank you for reporting it, and maybe send you a t-shirt.