Would you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it?
replyThat's not the only choice available.
replywhy don't you chill the fuck out. you've been harassing the op over and over here
replyI think you should take your own advice.
replyWell, it seems that no amount of explanations will satisfy you, so I would say you're the one pushing for a binary choice scenario. Hard...
replySo I can, maybe, understand your posture: what are your ties to Lovable?
replyNone whatsoever. What kind of a dumb question is that?
replyYou seem to be insanely hellbent on implying the actually worst possible intent to the researcher who acted in the good faith and contacted the vendor aiming for the quickest and best fix.
replyIt looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.
This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.
I haven't made a single statement about their intent.
replyI have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.