Comment by lovasoa

The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.