&gt; If he kept each of those credentials, and then logged into other systems using higher-privilege accounts that he&#x27;d compromised even after the SQLi is fixed, he is basically continuing the exploitation of an already-fixed bug.<p>Why did those credentials still work post-report?<p>What if those credentials were accessed from a public dump?<p>The outcome of this entire clusterfuck of a bounty is one of the reasons there are still very well paid blackhats. There are no rules or terms to follow.<p>If their terms aren&#x27;t clear (the terms he&#x27;s citing certainly weren&#x27;t intended for keys, rather Facebook user accounts&#x2F;information), pay out and fix them.