Binance fixed the IP whitelist gap — but the disclosure process is still broken

I recently re-tested an old Binance API finding I had reported through Bugcrowd. The original issue was about Binance API IP whitelisting and derived listenKey stream credentials. At the time, a listenKey could be created from a whitelisted IP and then used from a non-whitelisted IP to consume pri