As someone who receives vague security emails from folks who say we have a 'vulnerability' and ask if we have a 'rewards program for bugs' and try to ask 'how m

As someone who receives vague security emails from folks who say we have a 'vulnerability' and ask if we have a 'rewards program for bugs' and try to ask 'how much money I will be paid for the bug', Dylan's first email is very legitimate and specific. It comes from a non-generic domain (ie, not a "john.smith.1234@gmail.com" email), with an identity that could easily be verified. In fact, as someone who would work on the API facing side of things, even that report would be enough to discover the areas to dig around and find the vulnerabilit(y|ies). There must be an API or HTTP or some other endpoint that takes in a user id, rewards card, zip code, phone number or something similar and returns data for an arbitrary user(s). Let's audit all our endpoints and see where the vulnerability might be. I've also reported similar vulnerabilities before, and I have received a whole range of responses.