Key quote:<p>&quot;Since the Faceboook Whitehat rules state that researchers need to &quot;make a good faith effort to avoid privacy violations&quot;, I avoided downloading any content from those buckets&quot;<p>Listing the contents of the bucket is very different from fetching them. Without listing the contents, he wouldn&#x27;t know the severity of the vulnerability. There&#x27;s nothing wrong with that.