That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is t

That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right? Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.