In my opinion: the Pager Duty team did okay. Disclosing sooner would have been cool, but then again law enforcement might have had the gun to their heads on dis

In my opinion: the Pager Duty team did okay. Disclosing sooner would have been cool, but then again law enforcement might have had the gun to their heads on disclosing anything. They explained their bcrypt implementation awkwardly, though. This is what their code did: https://github.com/plataformatec/devise/blob/1a0192201b317d3f1bac88f5c5b4926d527b1b39/lib/devise/encryptor.rb https://github.com/plataformatec/devise/blob/1a0192201b317d3... I would not have advised them to go the pepper route, but it's probably a moot point now. In their favor: When asked, they gave specific answers up to the point that they were allowed to by law enforcement. More companies should follow their example here.