I am sorry, this is "Resolved"? How can they even consider marking this resolved in any situation. Yeah we exposed your env vars but we told you about it over email so it's all good... We dont know how or to what extend though.

What would you consider appropriate action for their incident team to be able to mark the incident on their status page as resolved?