He phoned the researcher&#x27;s CEO and subtly threatened legal action. This is spin at it&#x27;s finest.<p>I agree the researcher shouldn&#x27;t have escalated&#x2F;pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from &quot;so-so&quot; to &quot;holy shit&quot;.<p>Whether this policy for disabling pivoting is realistic&#x2F;a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn&#x27;t hesitate, however FB can&#x27;t have people crawling around their internal network, potentially breaking or leaking user information.<p>The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+.<p>EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says:<p>&gt;  Intentional exfiltration of data is not authorized by our bug bounty program<p>However the ToS only talks about USER data. AWS S3 keys aren&#x27;t included we can assume.<p>This is a tricky situation.