[ceejayoz]

If the vulnerability can't be revealed for "ethical" reasons, that implies it's ongoing... so what would a reset do? Wouldn't the newly reset credentials be just as vulnerable until fixed?

[1970-01-01]

Keep changing it until he says it's OK to stop. /sarcasm