This isn&#x27;t all that complicated, as far as I can tell.<p>Guy discloses a vulnerability.  He knows it potentially has wide reaching security concerns, and downloads enough data to prove that if necessary.<p>Guy gets shortchanged on the bounty, indicating that either a) facebook is trying to shortchange him, or b) facebook doesn&#x27;t realize how big of a vulnerability this truly is<p>Everything about Facebook&#x27;s response indicates b): they didn&#x27;t realize how big a vulnerability this truly was. Otherwise, the data he downloaded would have been useless by the time he used it.<p>You can argue that the guy &quot;went rogue&quot; by hostaging information, but fact is he deserved to be paid more and he was able to prove it.  Now facebook looks bad.