Either way, this is a fairly noob error - confusing authentication with authorization. I'm very surprised that business critical G Apps team hasn't caught on to

Either way, this is a fairly noob error - confusing authentication with authorization. I'm very surprised that business critical G Apps team hasn't caught on to this before. They should probably give him the maximum reward just to attempt to save face on this. Anyways, from now on (from http://www.google.com/about/company/rewardprogram.html http://www.google.com/about/company/rewardprogram.html): >If you have found a vulnerability, please contact us at security@google.com. Feel free to be succinct: the mailbox is attended by security engineers, and a short proof-of-concept link is more valuable than a video explaining the consequences of an XSS bug. Oh: if necessary, you can use this PGP key.