&quot;Maybe it&#x27;s because he&#x27;s one of several people to disclose the same vulnerability&quot;<p>The thing that gets me about this whole situation is that Facebook either didn&#x27;t understand the extent of the vulnerability (which seems to be the case to me, and in which case I think Wes Wineberg should have been rewarded far greater than they did for showing them how serious it was, though I wouldn&#x27;t say this is literally a &quot;million dollar&quot; bug) or they were grossly negligent for not patching it up a lot sooner than they did.  They can&#x27;t have it both ways.<p>Are they bad at managing their bug bounty program, or just bad at responding to serious security issues?  It has to be one or the other.