Facebook&#x27;s terms say they will not prosecute &#x2F;report whitehats to law-enforcement. Facebook could prosecute, at the price of some goodwill from the security industry (or part of it). I&#x27;m sure a competent lawyer to mount a robust defence for the security researcher (beyond reasonable doubt, IMO).