How did you got the “out of scope” to in-scope? Did you found any API keys that could be used to exploit the prod server?