Assuming that&#x27;s true (and I personally don&#x27;t believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It&#x27;s fully reasonable to escalate to an employer if they seem to be affiliated with the security researcher&#x27;s report.<p>Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work with and are associated with in a security report.