Running a bug bounty is not a suicide pact.  A team had to convince a finance group that it was valuable to give money away to people who might be assholes.  Bounty hunters are not a community- but if you are a bounty hunter, you should understand that many of your peers are total assholes.  The company that wants to pay you a reward has to figure out if you are going to make them regret offering you a reward.<p>There are 4 categories of reporters: great, good, shit and crazy.  Again- if you are a reporter, you should be trying to make it easy for the team to distinguish you in one of the first two categories by being simply being polite &amp; respectful.<p>I will take a side- it&#x27;s Facebook.  Dumping data is the end of the Proof of Concept.  Trying to determine if there is more data you can access through a single vulnerability chain is over the line.<p>Boats sink.  The engineers know it.  If you sink a boat in order to prove the boat had a hole, you will not get your payout.<p>And one final thought-<p>In my experience, bounty hunters almost never realize the full consequences of a vulnerability that receives a reward.  Most of the time, the &quot;Bad thing&quot; that they identify is just the tip of the iceberg.<p>The choices of the researcher reflect inexperience and immaturity.  The researcher has a significant misunderstanding about what is happening in the bug bounty marketplace.  I think they need to apologize if they want a future in the infosec world.<p>Publishing this blog post was a huge error.  Going to the journalist was another huge error.  I don&#x27;t see how this person could ever be considered employable by a reputable company.