Not the full story, and not a sham in this case. The bug report was in fact invalid, the OP was mistaken and later admitted so himself in the original thread on HackerOne:

https://hackerone.com/reports/124975

Source: https://twitter.com/jstnkndy/status/713077746507911168

Unfortunately he did not think to update his initial Reddit post afterwards.

EDIT: ...and now the post is gone.