Thanks for the writeup. Based on what you&#x27;ve written, it sounds like you <i>would</i> have been surprised if Facebook had paid $1 million for the original report (and no further nefarious behavior by OP) since it was probably due to a simple oversight, even though it was a RCE that obviously could have been turned into total ownage of instagram. Is that accurate? If so, what class of vulnerability would make you say &quot;Yep that&#x27;s totally worth $1 million&quot;.<p>Or do you think he should have just stopped and Facebook should have realized how bad it was and paid him a lot more than $2500?