If facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this. I would guess facebook gets a fair number of b

If facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this. I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market. https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=12172699 https://news.ycombinator.com/item?id=12172699