The &quot;bug&quot; here is that they aren&#x27;t really keeping track of their AWS buckets and keys at all. Least privilege, access logging, remote IP flagging, etc. These operational failures are ostensibly the responsibility of the CSO.<p>I&#x27;m not saying this researcher was 100% in the right, but this is the CSO ass covering. &quot;Don&#x27;t pay attention to the obvious operational deficits, the problem is the researcher overreaching.&quot;<p>A simple phone call directly to the researcher that cut through the bullshit would have made everything better. But he had to make sure it didn&#x27;t get out and the only way he could do that was by using the only leverage he had: The researcher&#x27;s employer.