Did this exploit actually got exploited? Or did they notify the site and gave them an opportunity to fix it before they released their findings?