Terms of their bug bounty program just says "You may not publicly disclose the vulnerability prior to our resolution" ... https://hackerone.com/twitter

Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).