Right, this feels like a way for Facebook to simply not payout a bigger bounty after they realized how big an appropriate bounty would be.<p>If the author submitted the RCE, and nothing else: is someone at Facebook actually going in and trying to simulate what he actually did?  Who knows, because the process is pretty opaque.  If you argue with Facebook&#x27;s assessment, and go and further exploit the system to say &quot;no, this is actually how bad the RCE is, in the grand scheme&quot;, you&#x27;ve now actually gone and proved what can be done, against their guidelines, which potentially disqualifies your initial discovery altogether.