Why they can't publish an expoit so people can run it against their own servers to check the impact?