I submitted a report, where I was able to buy ETH without a verified account.
They fixed it immediately after first replying to my report. (see: https://steemit.com/cryptocurrency/@bboybz/coinbase-potential-loophole)
Then they reply days later saying I was not able to escalate my privilege (which I did), and that my account was verified before I was able to make what should've been an impossible transaction.
If that's the case then I should be able to still purchase ETH but that ability was cancelled when they saw my bug report.
Then they threw me to their terrible support@coinbase.
They take FOREVER to reply to your ticket and finally when you get a message, if you go to reply to that message you get an automated response saying to submit a ticket and that you cannot directly email them! There is no way to do any sort of efficient back and forth!
Stupid coinbase....
... and my hackerone ticket is closed and they refuse to make the payout they are supposed to. Terrible customer service.