Thanks for your answers @ThoriumBR and @ConorMancone. Don't worry, I'm not taking this badly and I'm glad to know everyone opinions, otherwise I wouldn't have asked my question !
I get your respective points and we do store some very very sensitive data so you're right that this incident could cause us a lot more money than just a bounty. And my head will be the first to fall aha.
I recontacted the bug hunter, which I denied bounty and I offered him a bounty.
I still highly disagree with the method, bug hunters should go to the vendors first ! I have contacted the vendor and he had not bee…