If the researcher didn&#x27;t try to find what he could do with those AWS keys, they would likely be still valid. It&#x27;s conceivable that some other people have found them too and did the same the researcher did, only kept everything to themselves. Thus, if the researcher didn&#x27;t do the thing you consider bad, users of instagram would currently be more vulnerable. Why is then the thing the researcher did bad?