Summarizing what I&#x27;ve seen here in analogy form:<p><pre><code>  Researcher: &quot;I found a way to unlock your door&quot;

  Facebook: &quot;Thanks, here&#x27;s $2500. We&#x27;ve now fixed the problem.&quot;

  Researcher: &quot;Oh, BTW when I unlocked your door I rifled through
    your stuff and found your passport, your banking details, and a
    lot of personal information. I&#x27;ve kept copies of these. I also
    found the keys to your car and looked inside, where I found a box
    in the trunk. That box contained sensitive documents including an
    employee badge &#x2F; proximity card. I used this card to gain access
    to your workplace. In doing this, I also managed to get into the
    janitor&#x27;s closet which had a set of keys. I used these keys to
    get access to the complete building and took a look at all the HR
    files and rifled through a bunch of corporate contracts.&quot;

  Facebook: &lt;gobsmacked&gt;

  Researcher: &quot;Can I have my million bucks now?&quot;
</code></pre>
Where the researcher stepped over the line is using the door attack to escalate further attacks. It&#x27;s little different than finding a way to reliably impersonate Mark Zuckerberg&#x27;s credentials in such a way that others will 100% believe it. That finding is worthy of a reward. But then using that vulnerability to social engineer others to reveal passwords, using that as a launching point for mounting further attacks is going way too far.