You're confusing identities. We're talking about the responsibility of the person who is disclosing the vulnerability, not whether it's responsible for a perso

You're confusing identities. We're talking about the responsibility of the person who is disclosing the vulnerability, not whether it's responsible for a person to have a BoA account.