I don&#x27;t know. I feel bad for Alex but if we want to suggest that Facebook&#x27;s vulnerability disclosure policy was poorly written, I will ruefully agree.<p>When you stand up a bug bounty program, you are giving strangers permission to do something that they would otherwise be prosecuted for doing. You should be extraordinarily careful when you do that, and your rules of engagement should be crystal clear. These weren&#x27;t.