Yes, exactly this. Without escalating an RCE, how would he have been able to expose this absolutely huge flaw? The initial report was inconsequential, but this seems like at the very least a much more than $2500 bug. If things like this are considered &quot;unethical&quot; it kind of makes finding million dollar bugs in a bug bounty close to impossible.