>Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug.

I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one.

The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.