My two cents.<p>It seems that people defending Facebook&#x27;s behaviour in this thread have collectively lost sight of what the point of a bug bounty is to begin with - to encourage people to report issues, rather than sell them.<p>We now have people arguing that &quot;it is not acceptable to pivot beyond the initial intrusion for a bug bounty&quot;, even though <i>a malicious attacker would have done the exact same thing</i>. As long as standard no-damage rules are followed, where&#x27;s the problem?<p>The bug bounty program is working exactly as intended, but the researcher is getting dinged over arbitrary rules. As somebody else here mentioned already: the reason blackhat work still pays, is because such arbitrary and bureaucratic rules <i>do not exist there</i>.<p>We should not forget that bug bounties are a tool, not a goal - the goal is to convince researchers to report rather than sell, and <i>every</i> part of a bug bounty and its rules must be designed accordingly.<p>Also: Why the hell were those AWS credentials not revoked immediately after compromise? This constitutes a grossly negligent failure on Facebook&#x27;s part to assess impact, <i>on top</i> of their existing failure to have the &quot;keys to the kingdom&quot; on a single server to begin with.<p>And frankly, that failure only reinforces the need for the researcher pivoting into further systems, rather than just keeping it to a PoC - because evidently, <i>nobody</i> is going to assess impact at Facebook, if the researcher doesn&#x27;t do it himself.