The researcher has already updated his post regarding the use of his company email. Apparently your original point still stands:<p>&gt; I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.<p>Also, why would he be doing this work at the behest of his employer when (IIRC) Facebook&#x27;s bounty program only pays out to individuals? It would automatically make him ineligible to claim the bounty.<p>To me it seems like Alex Stamos tried to use some good old threaten-your-livelihood intimidation tactics and failed miserably.