His argument makes sense to me as to why that was needed, however if they want to take that stance, thats understandable, as is people being less likely to run things down for them.
> we noticed that you placed an unauthenticated web shell into our web root
(emphasis mine)
That being said, I imagine a phpinfo(); or passthru("whoami"); would have been preferred.
Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...)
As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.
Assuming you aren't referring to a SSH-2 implementation like OpenSSH, do you have any examples of something like this?