It&#x27;s clear to me after reading <i>between the lines</i> of both sides of the story, that Instagram&#x2F;FB sec team screwed up not acknowledging the severity of the bug and paying accordingly to the researcher.<p>Why get mad about a &quot;low level bug&quot;... I mean, if you can dump private user pics from a photo sharing app, how is this low level? really?<p>It&#x27;s also pretty clear that the researcher shouldn&#x27;t have dumped data although most likely he reserved this hidden card for later since he was expecting the lowball... but there are smarter ways to reply to lowballing.<p>IMO poorly managed on both parts.