It's stunning that HackerOne staff use their production credentials to reproduce security reports. Is there no internal instance of the HackerOne platform they can run their tests on?