Why do the policy specifics matter? A blackhat won&#x27;t be respecting those rules, and won&#x27;t need to negotiate a reasonable payday with facebook.<p>The real issue here is facebook&#x27;s poor infrastructure security and slow response time. If the exploit had been previously reported, why was the privilege escalation still possible? Why did a (supposedly) known-to-be-vulnerable host have access to secret information at all?<p>The exfiltration of data may have been unethical, but facebook has no one to blame but themselves for it even being possible.