Bug bounty is 500 Avios as a good will gesture. Please do disclose after normal timings - curious to hear. I can only just about book flights through their abomination of a web site, the thought of pen testing it makes me shiver.