Quite frankly I&#x27;m not surprised Wes is sour about how this was handled and the amount granted as bounty.<p>It&#x27;s very rare for a single vulnerability to grant you keys to the kingdom. If you check pwn2own vast majority of the hacks leverage more than one.
Most major attacks start with a small bug.<p>The real severity of the vulnerability is how far can it be pushed to broaden the scope. In this case that admin panel was just an entry point to a whole chain of security SNAFUs (aws keys in files at a multi-billion-dollar internet company, seriously?).<p>To reiterate, he got access to:
- source code
- aws keys
- plethora of 3rd party platform keys
- a bunch of private keys
- user data<p>This might not be the million dollar bug, but close.<p>Just thing about what an actual attacker could have done with it:
- login as &#x2F; impersonate ANY instagram account
- impersonate whole instagram (code + ssl keys!)
- inject malware into instagram app and sign it with your keys 
- download tons of user data
- wreck havoc in aws (possibly expanding what he has access to - we don&#x27;t know what else he would have been able to access had he spent weeks not hours exploring).<p>This is not a missing permission check allowing you to delete other peoples photos. This is huge and based of that credit and significantly higher bounty is due.<p>Aside from that the handling of the whole matter was not good:
- if your policy is not precise interpret it to your disadvantage. you screwed up not making it clear
- contacting his boss should only happen (if at all) after he has been asked the same account
- the post about &quot;bug bounty ethics&quot; misses the point. Following your logic heartbleed investigation should have ended when someone discovered a buffer over-read without exploring where that leads.