1. Email company to responsibly disclose leaked customer API keys.
2. We don't have a disclosure process. No bounty. We'll let you know if that changes.
4. Email company to disclose more leaked keys. Also ask on bounty updates.
5. Thanks, but because you didn't fill out this other form, no bounty.
6. Point out they never disclosed the disclosure form.
7. "Oops. Too bad."
This is why responsible disclosure sucks...