I don't think this case follows the usual story of "person reports vulnerability and is punished for it". See my other comment for details and a link:

https://news.ycombinator.com/item?id=20709592