In my opinion, they went too far and exposed themselves by telling the company. In all honesty, nothing good usually comes from that. If you wanted the truth t

In my opinion, they went too far and exposed themselves by telling the company. In all honesty, nothing good usually comes from that. If you wanted the truth to be exposed, they would have been better off exposing it anonymously to the company and/or public if needed. It's one thing to happen upon a vulnerability in normal use and report it. It's a different beast to gain access to servers you don't own and start touching things.