Why are you looking for off-site vulnerabilities? Would this be something you did even if they weren't running a bounty?

You should be careful testing sites out of scope. The bounty gives you implied permission to test for vulnerabilities on sites in-scope, but "I was just security testing" is demonstrably not sufficient to insulate you from civil litigation or even criminal charges --- you would probably win in court, but it would be ruinously expensive.

What are your thoughts on the bug bounties that have extremely limited scopes, considering the in-scope domains typically rely on the out-of-scope parts?

They are not explicit in what domains or ip addresses are in scope. This makes it difficult. You'd expect them to have a list of approved sites for testing.. But they don't (or didn't when I tested.)

You may as well give them an 'fix this or else I go public' with a reasonable deadline then. That's in everybody's interest.

Does the company not have any legal recourse against people going public (or threatening to go public) with a bug like this before it's fixed? If not, how is it that United can just mark unfixed bugs "as duplicates" and refuse to pay out for them? Shouldn't all those devs immediately go public with them?

Is there a kind of "union" for bug finders, some corporate shell anonymous hackers can hide behind to avoid legal crushes?

Anonymous hackers just use a mask. Sorry, I couldn't resist.

It sounds like they are disqualified from receiving any rewards any time in the future.

But other than that, there is nothing preventing you from revealing the vulnerability, or worse, selling it on the grey market. The US government is a heavy buyer of vulnerabilities (although usually in applications, not in airline websites).

There can be a fine line between full disclosure and blackmail. I would be concerned "give me airpoints or else" would go over it.

That's a good point. If you get something out of it then it's not exactly as if you only have the public interest at heart. Which makes me wonder what would be the way to act if you found a major vulnerability in some vendors product and they point blank refuse to fix it even given plenty of time. The public good would (could?) clearly outweigh the company's interest if the hole is bad enough but it could get extremely expensive if you went public with the flaw against their wishes (assuming they know who you are and you're in a location where they can make your life hard).

This is probably very different from jurisdiction to jurisdiction, here in NL we have a government watchdog for such cases which starting 1/1/2016 will have a lot more teeth but in other countries the situation will surely be very different.

Anonymity would seem to be an asset in such cases.

There's never really a line between blackmail and anything, only Cantor dust. :/

Blackmail is one of those rare crimes that consist entirely of legal conduct.

You could, but they have lawyers.