Comment by deepsun

> and asked me not to publicly mention it

Sounds sus. If they said it's "best practice" then certainly they'd want you to tell everyone about it.

If a bug bounty is denied I'd assume you're free to talk about it publicly.