> Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real

> Interestingly nobody would be fined by the regulator had the misconfiguration not been discovered by someone stupid enough to to post about it with their real name, organised criminals would have been smarter about it. Isn't there a third option, fully anonymous disclosure by a grey hat? Seems like the best outcome would be from showing it to a scrupulous journalist who protects sources, and it looks like you're discounting that.