Both tptacek here and Facebook claim that he found one bug.  He found at least two, depending on how you classify things: even if Facebook would not like to admit that their security architecture around token amanagement was&#x2F;is deficient, and the fuzziness of internal security boundaries makes &quot;bug&quot; somewhat hard to define, it <i>was</i> deficient by industry standards (especially for such a large and tech-focused company), and he got way more access than that RCE should have given him.  Whether or not he was supposed to go looking for such additional bug(s), it&#x27;s discourteous not to at least acknowledge that he found them, and thereby provided Facebook additional value over just finding the RCE.