&quot;The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit.&quot;<p>LAUGH.. Where does it say this?<p><a href="https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat&#x2F;</a><p>I think instagram should be asking themselves:  Would they rather have an honest researcher report this or North Korean hackers not saying anything and just slurping data?  Security Researchers are always going to see things they shouldn&#x27;t.  That&#x27;s just a fundamental rule.  You have to know who your real enemies are and not come down on someone just because they got a little enthusiastic.<p>Wes [edit] is one of the good guys - he went overboard, sure, but he should be rewarded, he should be asked not to go crazy next time, and the rules should be updated.<p>Personally, I think by saying the exploit was trivial shows that the CSO should be fired.   If he has to make a phone call, it&#x27;s not trivial.