I think the solution here is to pay $100k+ for RCE exploits and explicitly forbid pivoting access after the first vulnerability is discovered. Facebook offered $2,500 for a security vulnerability that could do much greater damage. What kind of vulnerability is a &quot;million-dollar bug&quot; if not RCE? How would you possibly have a &quot;million-dollar bug&quot; that is a single-point-of-contact bug and how would you verify that Facebook is paying you fairly? They didn&#x27;t seem to in this case.