An interesting decision on Alex&#x27;s part to only pay the $2500 for the RCE bug.<p>On one hand, this signals to anyone else who might want to disclose security issues that Facebook bounties don&#x27;t pay out anywhere proportionally near the full potential damage impact of the issue.<p>On the other hand, if they pay out a lot more now, they&#x27;re signalling that if you find a vulnerability, you need to dig deeper in order to have insurance in case Facebook gets stingy.<p>Probably the best outcome would have been to pay out a more proportional bounty, even though Wes&#x27; exploration was beyond what&#x27;s generally acceptable, so that Facebook&#x27;s bounty program reputation is preserved.<p>That or press criminal charges to discourage any other researchers from going over the line.