We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.
http://twitter.com/#!/homakov/status/176476394455437312
"Thank you all,sweethearts! For support, and shit too. One more thing to clarify. That tattoo is kind of fake made with henna. eat vegetables"
If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.
I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.
EDIT: On second thoughts, I think I am being overly critical on all parties. Instead, I think I hands up "we messed up, but we are learning" approach would be better, and we see how both sides act if/when this happens again, lessons learnt and all that!