Bug bounty appears to be a misnomer in this instance. Facebook is specifically asking for reports of security vulnerabilities in their policy:<p>&gt; If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away.[1]<p>Which then begs the question to me: how do you differentiate an acceptable and unacceptable probing of security vulnerabilities when you can&#x27;t capture the full impact of an issue without attempting to exploit it to its fullest? Because it is certainly not outlined in their policy.<p>And when you&#x27;re asking for any whitehat to attempt to discover and disclose security vulnerabilities in your system with only the limpest of guidelines around how to do so, I don&#x27;t feel that it is warranted to react such as Facebook has here.<p>[1]: <a href="https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat" rel="nofollow">https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat</a>