Not really, no.  Your <i>should not have had</i> is still presupposing a set of bug-bounty-hunter-professional-guidelines that don&#x27;t actually exist unless they&#x27;re specified in the program guidelines, and from a philosophical perspective the actual security vulnerability under discussion now is that their sec team is so lackluster that they can&#x27;t or won&#x27;t change out a credential set known to have been externally accessible (and, the critical point, to anyone who could have found this not-particularly-obscure vuln, not just this researcher).