Punishing someone for reporting a security fault is about the dumbest thing possible... unless of course they'd rather leak a couple hundred people's private information that admit they made a mistake. Oh wait, they probably would.