[flagged]
So, this is the report they complained about: https://issuetracker.google.com/issues/440183164
I don't know how a vulnerability report could be much better than that. It is a real vulnerability. The report includes a detailed analysis of where the vulnerability is. The bug has been validated, and the report includes exact reproduction instructions.
How is that a bullshit bug report?
The one nice thing is Google had submit a real bug at least.
The human idiot "researchers" will send paragraph long automatically generated extortion threats over not sending HSTS header
Because not disclosing an actual bug that could affect users would somehow be good?