The tech giant fixed the security flaw, netting a security researcher $10,000 for privately disclosing the bug.