It's a really nice and wholesome use of HackerOne. Nice that they acknowledged and awarded as opposed to some companies that try their best to push a security disclosure out of scope and not pay out a bounty [0] [1]

[0]: https://news.ycombinator.com/item?id=9278832

[1]: https://news.ycombinator.com/item?id=16000550