Give Tubs back his ePeen, he deserves it.

I think the system should work like this: A person ****s around and find an exploit. They test this exploit to make sure, and get something out of it (An ePeen, for instance).

The person then reports the exploit, and points to what they’ve done as proof that the exploit is real.

Because they reported it after confirming that it works, they should be allowed to keep the ill-gotten reward – within reason. In this case that means the ePeen but not all the flezz.

If after using an exploit they don’t report both the exploit and what they did with it, then they get permab&. If they spread the exploit around before it’s fixed, they also get B&.

This provides strong encouragement to both find exploits AND report them, while at the same time strongly discouraging people from abusing exploits.

That said, yea, give Tubs his ePeen back.