Exactly what you'd expect from an airline:

"Bugs or potential Bugs you discover may not at any time be disclosed publicly or to a third-party. Doing so will disqualify you from receiving award miles."

It's as if it was designed in the same spirit as a frequent flyer program -- really stingy payout, with lots of strings attached. I can't see how this can incentivise anyone to do free penetration-testing for them.