There's nothing confusing about it, it just doesn't frame it in the way you prefer. From the perspective of the developer, it's natural to assume that the pass

There's nothing confusing about it, it just doesn't frame it in the way you prefer. From the perspective of the developer, it's natural to assume that the password was in place to prevent non-users from accessing, not legitimate users. After all, the credential wasn't hidden or obscured in any way. When it became clear that users weren't supposed to have access, it was reported to the vendor. Am I missing something here? On one hand, there's a developer doing their job. On the other, there's another "embarrassed" company retaliating and intimidating would-be bug reporters. It seems crystal clear what's going on.