I think the root cause of the problem is the unclear policy by FB. Privilege escalation can be hard to catch, and can be a separate bug in and of itself, even if it requires a separate exploit to get the initial privileges.<p>The published policy didn&#x27;t say anything about not doing what he did. I&#x27;m not going to argue that what he did should or shouldn&#x27;t be ok, but FB has no control over what other people do. Yeah, maybe it&#x27;d be better if people asked for clarification first instead of asking forgiveness, but there&#x27;s no way to force them to do that. FB does have control over what their policy says and allows&#x2F;disallows. If you don&#x27;t want people to exfiltrate any data and look at it on a local machine instead of just keeping a session on the exploited machine, then put that in the policy. If you don&#x27;t want people poking around for other exploits after gaining access, then spell that out in the policy.<p>The point of the policy isn&#x27;t to stop everyone. Sure it will stop some&#x2F;most people, but some people don&#x27;t listen. The point is that when it happens again you can point to the clear policy and say &quot;you&#x27;re an asshole, we&#x27;re not paying you because you violated our explicit policy, and we are reviewing what you did with our lawyers to see if we should notify law enforcement&quot;.<p>Yes, doing this fix&#x2F;policy update now doesn&#x27;t fix this situation, but it prevents anyone else from doing something similar and claiming ignorance of this situation and FB&#x27;s position.