Is this not the point of a Whitehat bounty program? To entice someone to discover and disclose a bug in a trustworthy manner?<p>If they react this way, and can&#x27;t trust people to attempt to find exploitable security holes on their system (even those that yield private keys), then what is the point at all? The only people that find them then, are not going to be as cooperative about it.<p>&gt; Doesn&#x27;t the author know how long it will take them to recover from this breech? How much it will cost them?<p>This is not the author&#x27;s fault. He did nothing but disclose bugs that Facebook themselves set in place, and seemed to be very open with them about it, at that.