I hadn't heard about the carrot disclosure stuff, but I hope this doesn't become a common thing. Just saying "I can hack you" with some purported output from a script is pretty useless feedback.