In any case, there is one question remains. How do facebook defines a &quot;million dollar&quot; bug if the security team is not aware of the damage it can do. Since this is not the first time this bug was reported, did they actually give a big bounty to the first person who did the initial report(Given that it can lead to this much damage)? Or just another small bounty saying that it&#x27;s not a very important security flaw.