Also, it is not said by the brand that rewards will be given for finding the bug. Will they still give reward if you email them about the bug?
I think people who find bugs and security improvements are rare, and hence should any one find one on any campaign the brand or campaign manager will value him or her and will have to find ways to reward them. It would be very unfortunate if I'd get no reward at all for that and believe any serious bounty brand will give a very good reward for search a great work done. However the outcome may be, i would notify them, because exploiting bugs to earn money is very bad.