Without having a position in this debate myself: I think that&#x27;s not quite fair.<p>My understanding is this: They got a report that a server can be compromised and fixed that vulnerability. Unbeknownst the reporter grabbed a huge amount of (remote! not on that server, btw) data to play with.<p>Later the reporter returns to Facebook and says &#x27;Btw, I got all these valuable pieces of information and have those for quite a while&#x27;.<p>Only at that point can you panic and rotate keys, but now you notice that a third party had access to all these keys for a month already. What else did they get? Maybe the researcher sat in a posh coffee place and grabbed interesting Instagram credentials (using the certificate) or escalated this further, gaining even more access based on the exposed information so far.<p>In my world, Facebook&#x2F;Instagram are basically completely owned and have to assume that this guy grabbed ~everything~. They probably need to hire (vs. doing a bug bounty) people to grab the same data from the same buckets to look for potential follow-up targets that were _not_ disclosed, but might&#x27;ve fallen to the same bug hunter.<p>Who&#x27;s to say that the guy doesn&#x27;t come around on New Year&#x27;s Eve with Yet Another Disclosure based on the same &#x27;attack&#x27;?<p>I hate the &#x27;contact the employer&#x27; part, but I&#x27;d hate to be in FB&#x27;s shoes far more. I can hate the company and feel for its CSO&#x2F;IT staff in this aftermath at the same time.