Thanks for sharing your story! A decent amount of disclosure programs explicitly call out social engineering as unacceptable conduct and submissions. However,

Thanks for sharing your story! A decent amount of disclosure programs explicitly call out social engineering as unacceptable conduct and submissions. However, social engineering is a very valid method for attackers and in many cases, offers the path of least resistance. While I understand why companies don’t want good faith security research to call and try to trick the human factor, this is still a very real attack vector that needs attention and to be fixed as in what you’ve described.