You&#x27;re HN&#x27;s anointed expert, so I suppose all I can say is that&#x27;s not my experience.<p>Among the many reasons bug bounties are bad ideas is that they generally fail to write clear rules -- as Facebook did.  As written, what he did is not against the rules and while it may fall into some best-practices bucket you assert to be universal, that&#x27;s hardly sufficient for a field in which participants can come from any background.  But please, continue to defend your friend whose multi-billion company had a month to cycle their popped keys and failed to do so, then responded by threatening a researcher&#x27;s employment after multiple conciliatory e-mails.