There is no reason for the researcher not to retain those keys, IMO - Once those keys were found to be compromised by the company, they should have been revoked immediately, and considered &#x27;in the wild&#x27;.  The fact that they didn&#x27;t revoke these keys is basically a security violation itself.<p>Dumping the users table on an &#x27;internal&#x27; (heh) dashboard -- any company that is doing these bounty programs needs to clarify what a &#x27;user&#x27; is.  Is it someone using their application, or all employee information as well.  It&#x27;s an important distinction.