dsacco is correct in my mind. I work as a security researcher and penetration tester, and I would only include this in a client report as an informational or lo

dsacco is correct in my mind. I work as a security researcher and penetration tester, and I would only include this in a client report as an informational or low risk vulnerability at best in a vulnerability assessment. In a penetration testing narrative I likely wouldn't even bring it up. Even if we look at the social engineering side of things, this is likely not something I'd bother with. There are so many social engineering attack vectors I would give priority to over this as an attacker. A hardline really does need to be drawn with regards to bug bounty programs, or we would constantly be chasing the proverbial rabbit.