The flight provider operates a "bug bounty" scheme that rewards hackers for privately disclosing security flaws rather than sharing them online.
It has given the maximum reward of a million flight miles, worth dozens of trips, to two people.
One security expert said the scheme was a big step forward for online security.
"Schemes like this reward hackers for finding and disclosing problems in the right way. That makes the internet safer for all of us," said security consultant Dr Jessica Barker.
"Bug bounties are common in tech companies as they tend to understand online security a bit more, but other industries are catching up," said Dr Barker.
The idea of responsible disclosure, reporting issues and giving companies time to fix them, is not new.
Big technology companies such as Yahoo, Google and Facebook offer hackers cash incentives to report bugs privately.
In return for receiving their flight rewards, hackers are forbidden from revealing the nature of the security holes they discovered.
"We believe that this program will further bolster our security and allow us to continue to provide excellent service," United said on its website.
The company declined to comment further.
"It's not always about hackers digging around looking for flaws. A hacker may be using a service and notice something a bit off," said Dr Barker.
"We all benefit if they look into that," she added.
Some critics of bug bounties say they can discourage companies from hiring professional security staff, because it's cheaper to offer hackers cash for disclosing bugs.
Dr Barker disagrees: "It should be part of an overall approach to security, but it's definitely a good approach.
"It encourages positive behaviour and shows young hackers that they can benefit from doing the right thing.
"Bounties can also benefit smaller companies who can't afford to give out cash rewards but can offer free products or services, so I hope we'll see more and more bug bounties," she said.

Speaking after briefing the Security Council on the peace process, Staffan de Mistura said a partial truce agreed in February was "barely alive".
Violence in Syria has intensified in recent days, despite the ceasefire.
At least 20 civilians were reportedly killed on Wednesday in government strikes on a hospital and nearby residential building in eastern Aleppo.
The dead included children, a dentist and the only paediatrician left in rebel-held areas of the city, civil defence volunteers told AFP news agency.
The upsurge in fighting in Syria's largest city comes amid reports that government forces, backed by Russian air power, are gearing up for a major offensive there.
Russia's continuing war
Has opportunity for peace been lost?
What is left of Syria?
Assad's growing confidence
The escalation has threatened to derail the UN-brokered peace talks, which resumed last month.
The Western-backed opposition delegation, the High Negotiations Committee (HNC), last week suspended its role to protest against alleged ceasefire violations by the government and a fall in humanitarian aid deliveries to besieged areas.
Speaking on Wednesday after a third round of talks in Geneva, Mr de Mistura said the fragile "cessation of hostilities" "could collapse any time".
He said that over the past 48 hours an average of one Syrian had been killed every 25 minutes and one wounded every 13 minutes.
For the peace talks to succeed, Mr de Mistura said, hostilities would need to be reduced to the levels seen immediately following the February agreement.
Calling on the US and Russia to co-operate, Mr de Mistura said that the legacies of both President Barack Obama and President Vladimir Putin were linked to the success of the peace process in Syria.
There will be one or two more rounds of talks before July, Mr de Mistura said. He added: "There are still major differences on the major issues, but there is movement on certain areas where there was not before."
Mr de Mistura also said that equal rights and equal representation in major institutions for women was essential to the transition to a new Syria.
The peace talks do not involve the al-Qaeda-linked al-Nusra front and the so-called Islamic State, which have been fighting government forces and other rebels across Syria.
The UK-based Syrian Observatory for Human Rights monitoring group confirmed on Wednesday that the air strikes on a hospital and nearby buildings in Aleppo were carried out by "regime airplanes".
Separately, 11 people were killed in western Aleppo earlier on Wednesday, the Syrian Observatory said.
More than 270,000 people have been killed since Syria's bitter civil war conflict erupted in 2011 and millions have been forced to flee.
US airline United has rewarded two hackers who spotted security holes in its website with a million free flight miles each.
[NEXT_CONCEPT]
The UN envoy to Syria has urged the US and Russia to intervene "at the highest level" to save struggling peace talks.