Yes it is complete bullshit. This account is full of minimizing Facebook&#x27;s role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works).<p>&gt; His account on our portal mentions Synack as his affiliation<p>Note &#x27;his account&#x27; here is just his Facebook account. So you can rewrite that line as &#x27;his Facebook account lists him as employed at Synack&#x27;<p>&gt; he has interacted with us using a synack.com email address<p>That would be a crazy new precedent if we use email addresses as authority<p>&gt; and he has written blog posts that are used by Synack for marketing purposes.<p>having <i>written blog posts</i> is even crazier.<p>Were Alex <i>genuine</i> in thinking this was Synack he would have copied Wes on the email and&#x2F;or he would have asked him. He straight up went behind his back and over his head.<p>Facebook had a bounty program that was very respected and operated well. I don&#x27;t understand how they&#x27;ve completely fucked this up and turned it into a pissing contest.<p>Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with.<p>This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake.<p>I really, really don&#x27;t get this.<p>edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real&#x2F;public name. avoid blowback, everyone gets it at least once.