I wonder if if that person just emailed them vulnerability, then it would just get patched within a day and he got only $1000.