The main point is the thing that OP found is really important for Prezi. I don't really understand why they have to figure out whether the vulnerability is in "the scope", or not.