Alex has in the last few months built one of the best teams in application security at Facebook (Facebook security is now seemingly most of O.G. iSEC Partners). I get it, everyone hates big companies and especially Facebook evil Facebook but, come on. They know what they&#x27;re doing.<p>If you understand how security works inside of big companies, this is a really silly theory to run with. CSOs are <i>happy</i> when shit like this gets discovered, because it gives them ammunition to get the rest of the company to adjust policies.<p>If you were working from the understanding that a CSO comes in and just immediately tells a team of (what is it) NINE THOUSAND developers how to do stuff differently... no. That&#x27;s not how it works.<p>The problem is that nobody at Facebook with the possible exception of like 10 people none of whom are Alex can make huge operational changes like &quot;change all the ways we store keys across an entire huge business unit&quot;. So, you tell Alex you took AWS credentials he didn&#x27;t know existed and you&#x27;re going to start mining them for a story you&#x27;re bringing to the media, and now Alex is in a position where he&#x27;s NOT ALLOWED to sit back and try to manage the situation himself.<p>Delete the keys or I have to tell legal what&#x27;s happening.<p>The researcher <i>NEEDED TO HEAR THAT</i>.