Instead of tipping me off, though, Neill sent me an email claiming that he had found the biggest security bug to date—in the very VMS log-in program I had asked him to analyze. He confided that it was so sensitive that he was willing to send it to me only in the post .