Advice about claiming a bug bounty

Hey everyone,

I found a bug in an app and wanted to get some advice on whether this is considered bug bounty–worthy and how to handle it properly.

Basically, if I attach a card with no balance and spam-click the “buy” button, the transaction still goes through on the app’s side even though the payment itself isn’t actually processed. From what I can tell, the app ends up granting the purchase without ever successfully charging the card, and there’s no automatic chargeback or correction happening afterward.

This seems more serious than just a UI glitch since it looks like it could be used to get items/services for free.

I’ve already contacted the company, and a manager said they’d follow up with me. I haven’t exploited it beyond confirming it works, but now I’m not sure what to expect next.

A few questions:

Does something like this typically qualify for a bug bounty?

How severe would this be considered (low/medium/high/critical)?

Is it better to wait for them to offer something, or should I bring up compensation?

If I do ask, what’s a reasonable range for something like this?

Anything I should be careful about saying or doing at this stage?

Would really appreciate any advice from people with bug bounty or disclosure experience.

Disclaimer: I barely know anything about coding so I won’t be able to help solve anything from that end.