Pretty shitty of HackerOne to forbid the disclosure of a non-vulnerability. Hopefully there's more to this story.