Did I mention that the other pentesters on the team completely missed that remote code exec I found? I hate to brag, but sometimes it's the best way to get a po

Did I mention that the other pentesters on the team completely missed that remote code exec I found? I hate to brag, but sometimes it's the best way to get a point across. Security is so hard that you can't find everything. One of the dirty secrets of the security industry that nobody likes to talk about is that when you do a pentest, you're deemed secure, but it's overwhelmingly likely that the pentesters didn't find all the vulnerabilities. Security breaches are rare, which is why this system works. But it's not malicious -- it's just very, very hard to be secure all the time. Security isn't even a priority in most cases. I get that you're saying Facebook has resources. But with resources comes scale. How many programmers do you suppose worked on that feature? It could be one or two out of a dozen assigned to that arm of the project. Or it could be a dozen involved in a multi-month refactoring of spaghetti code. Or it could be one overworked person who threw in a "fix" before crawling home to bed. FB hires exceptional people, and even exceptional people ship bugs. By the way, two weeks is a tiny amount of time. A real-world pentest takes about that long to book, unless you already have pentesters on retainer. I'm sure Facebook does, but as I said, pentesters can't catch everything.