Yes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd ac

Yes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd actually consider that a surprisingly high amount, and I would expect that many companies wouldn't consider this class of bug a bounty-worthy issue at all - "thanks for the report", maybe fix it maybe not, but no bounty.