I don't understand why this is considered a security incident. Human behavior incident, sure, but this is not a vulnerability.