I would tend to agree.<p>Facebook&#x27;s point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view though. &quot;See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user, and then I&#x27;m just one click away from accessing all the instagram pictures I want.&quot;<p>Although Facebook&#x27;s handling of the problem is poor (why didn&#x27;t the CSO call the author directly to get things squared out? He does not talk to people who are not C*O?), they do have a point.<p>I think the author acted in good faith, but got carried away by his findings unfortunately.