I am really disappointed at Facebook for their stance in this situation. The blog post written by Alex reaches far too into the personal attack territory.<p>&gt; We were surprised because he did not mention these actions in his previous correspondence with us.<p>Painting a picture&#x2F;creating a narrative, poor us, we&#x27;re surprised.<p>&gt; it was reasonable to believe that Wes was operating on behalf of Synack<p>Filling in affiliations, or using a company address during parts of communication could very well have been out of detailing legitimacy as well as convenience. You can not, and should not infer a researcher operates on behalf of their company when reporting a bug, and as a CSO and someone who acts as a security researcher you KNOW that we always distance ourselves from our workplace when reporting or talking about security.<p>&gt; Wes to set a precedent that anybody can exfiltrate unnecessary amounts of data<p>Logging in, grabbing keys but not touching user data is most certainly not breaking your ToS. Yet you paint it as unethical here. Where do you draw the line? Internal network names? Internal IP&#x27;s, passwd files?<p>&gt; one of my engineers involved in this issue once found a great (and in his case, original) RCE<p>Really, &quot;and in his case, original&quot;? Come on, act professional you&#x27;re presenting one of the largest companies in the world.<p>&gt; we have no evidence that Wes or anybody else accessed any user data<p>DING! DING! DING! Yet using terms like &quot;intentional exfiltration of data&quot; to draw grey areas that convenience you.<p>They&#x27;ve definitely screwed the pooch on this one.