Let's imagine the following: There is a web shop and they have a 5$ off coupon code. The intention is that you can use this code only once. But it is possible to use it multiple times so you can buy everything for free. Is this considered a security vulnerability? I know it's not like a buffer overflow or sql injection. But there is something wrong in the code.
I had this this week. A big software company we all know was/is affected. They must have been/must be losing $10.000s (the bug is public). I reported it as security vulnerability. I said I want a bug bounty. But it was rejected. They said it was not a security bug but a normal bug. What do you think?
(I don't want to say what exactly it was because I don't want to spread security vulnerabilities.)