I disagree. It&#x27;s not about whether or not he downloaded the data. That is an undisputed fact between both parties.<p>The question seems to be if he did it in good faith and within the rules of the bug bounty program.