You don&#x27;t know that&#x27;s what happened, even the researcher didn&#x27;t say that. You&#x27;re extrapolating.<p>A much more reasonable and likely explanation of the same set of things we&#x27;ve been told:<p>Alex Stamos called Synack and said that the AWS credentials, which, by the researchers own admission, he&#x27;d chosen to retain long after the vulnerability he reported was fixed, had to be deleted, and that if they weren&#x27;t and the researcher continued to use them, the situation would be out of Stamos&#x27; hands and into Facebook legal&#x27;s, at which point he couldn&#x27;t keep him from being prosecuted.<p>In that interpretation, Alex isn&#x27;t threatening the researcher; he&#x27;s (very reasonably) saying &quot;you cannot use these credentials you&#x27;ve taken from the server, and if you keep doing that, I can&#x27;t take responsibility for how Facebook will handle this, so you should stop right away before you harm yourself.&quot;