3 ms·

IMO The student didn't expose the flaw (if you can call it that) he exploited it and refused to take it down.