Without defending the researcher here, I thought that was the weakest point in Facebook&#x27;s response.  Was he interacting with Facebook using his synack.com email address <i>during this exchange</i> rather than at some point in the past?  Was he signed up on Facebook with his synack.com address?  (I haven&#x27;t used the bug bounty program but it appears to require a user account.)  Did he mention his employment with Synack in the course of the exchange?  If any of those things were true, I suspect they&#x27;d say so, rather than leaving it at &quot;has interacted...&quot;<p>I don&#x27;t know, if the guy was just shaking them down then maybe trying to get him fired is indeed a reasonable thing to do, but I don&#x27;t buy that anyone would have just assumed under the circumstances that he was doing all of this on the clock.