yeah what a mess. For me the worst part of the story is how they ghosted the security researcher for 6 months despite having replied to him at first.