I&#x27;m struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more to be gained after he had those API keys - for any other researcher its game over, you won.
As far as I&#x27;m concerned anything that happens to you after that point is of your own making