If he had told Facebook that at the same time as he reported the credentials he harvested from the database --- which his timeline suggests he could have --- I&#x27;d agree with you.<p>But he didn&#x27;t. He put the credentials in his back pocket so he could pull them out when they suggested he hadn&#x27;t found his &quot;million dollar bug&quot;. And so for a month after they fixed the bug, some fucking rando is walking around with credentials to all of Instagram&#x27;s AWS assets, totally unbeknownst to anyone at Facebook. They turn down his bid for his &quot;million dollars&quot;, and he busts the credentials out on them. You think they&#x27;re going to <i>thank</i> him?<p>He&#x27;s lucky it was Stamos and not Mary Ann Davidson.