If they discovered the AWS credential thing on December 1 after the security researcher reported it, and wouldn&#x27;t have discovered it otherwise, and it could be the case that someone else found the exact same attack path first, shouldn&#x27;t they reward him for making them aware of a problem they would not have otherwise noticed? That they wouldn&#x27;t have fixed? That others that discovered the same attack path might otherwise still openly exploit to MITM all the traffic, to do arbitrary things with arbitrary user accounts?