>I'm satisfied that commercially reasonable efforts have been made to ensure there wasn't deliberate exploitation of the bug. How would you classify people usi

>I'm satisfied that commercially reasonable efforts have been made to ensure there wasn't deliberate exploitation of the bug. How would you classify people using all of the crawled data though? It seems sort of hand-wavy to claim nobody deliberately exploited the bug if they used leaked session tokens in crawled data to get access to user accounts.