> You don't need to treat me like the bad guy when I'm clearly not exploiting you. I'm not seeing where Google treated him like a "bad guy"? It sounds like he

> You don't need to treat me like the bad guy when I'm clearly not exploiting you. I'm not seeing where Google treated him like a "bad guy"? It sounds like he was expecting Google to sing his high praises, which of course didn't happen. The bug bounty payout also has qualifications that the author didn't come remotely close to meeting ( http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/ ), so I have no idea why he expected he should get paid. By his own admission he doesn't know how the attacker got access to his account, nor where the $20k came from. So what vulnerability did he find? I guess Google's failure here was to protect the author from his own lax security.