&quot;As a researcher on the Facebook program, the expectation is that you report a vulnerability as soon as you find it. We discourage escalating or trying to escalate access as doing so might make your report ineligible for a bounty. Our team accesses the severity of the reported vulnerability and we typically pay based on its potential use rather than rely on what&#x27;s been demonstrated by the researcher.&quot;<p>Well, FB feels your bug bounty is worth $200?  Strike that figure.  We feel like your bug bounty is worth a $100 advertising credit, if you buy $100 in advertising?  Next time just report the bug.  Thanks!<p>(I don&#x27;t know if my innate dislike of FB, or I feel it shouldn&#x27;t be up to a company to determine what they feel a bug is worth?  If you are going to have a bug program--put in some Very solid rules?  They shouldn&#x27;t be just winging it at this point?  It&#x27;s not some cute little start up?  It&#x27;s a huge machine that&#x27;s making a fortune off it&#x27;s  victim?<p>I&#x27;m still not sure if FB really cared about this hacker&#x27;s escalation of a potential attack, or it&#x27;s about money? Would I want a hacker to show me my vulnerability with my clients information--no, but make that crystal clear in the TOS.)