Yeah - but it&#x27;s 100% clear from this that FB wanted to brush the RCE under the carpet with a &quot;not at all severe $2500&quot; classification - without ever admitting to losing their private ssl keys or auth token seeds.<p>He clearly _did_ have a &quot;security vulnerability&quot; that gave him the keys to the kingdom. He knew it, and Facebook know it - and they wanted to pretend it was no big deal.<p>Any bets on how many months till there&#x27;s a large-scale breach of Facebook user data? The reality of the balance between responsible disclosure and selling an exploit is much easier to evaluate now.