It's covered by the department of state's vulnerability disclosure program. As long as you don't do anything outside of the program guidelines you should be fine. https://hackerone.com/us-department-of-state/policy_scopes

my tax dollars are paying for these tokens so I should be allowed to use them as I see fit