Zendesk: Email user verification bug bounty report retrospective