&gt; by revealing that he&#x27;d retained AWS credentials from Instagram long after they&#x27;d closed the vulnerability that he used to get them.<p>How would that change anything?<p>If Facebook did rotate all keys the moment the researcher reported it, they made no difference.<p>If Facebook did not, then they aren’t taking care of their security properly.