I feel that privilege escalation&#x2F;lateral movement is implicitly discluded from almost all bug bounty programs, most researchers know that.<p>It&#x27;s a really grey area beyond an initial &#x27;access bug&#x27;, so it pays not to go there. Otherwise, where should Wes have stopped? keep proving more vulnerabilities until he&#x27;s downloaded their code? or got private photos of Zuckerbergs kid? Just to show that it is indeed a serious bug?