Then I would ask why is this vulnerability not up for monetary compensation? http://www.google.ca/about/appsecurity/reward-program/ http://www.google.ca/about/

Then I would ask why is this vulnerability not up for monetary compensation? http://www.google.ca/about/appsecurity/reward-program/ http://www.google.ca/about/appsecurity/reward-program/ It is a script that allows one to control behavior (even though in a limited way, but yet authentic way) of Google's web property. Why did they say that this was not a security sensitive issue? And why did the tone change upon seeing public disclosure looming? Anyways, I am not happy about handling of this situation. Good on Tom for being responsible, and the exploit did not wander into irresponsible hands. Because, within a day everybody on Google Scholar would have got this exploitable email.