Reminds me of a time I found a serious issue with mailgun. Messaged them, no reply. Had to spam their twitter to get a response. Basically you could have stolen tons of API keys from users without their knowledge and mailgun never disclosed it.

I could have actually gone to their office in person if I wanted to be pedantic but it actually seemed like a pretty weird office space lol.