I wasn't sure from the title if the article was about: 1. Facebook paying security researchers to find and report vulnerabilities. 2. Facebook paying (in user

I wasn't sure from the title if the article was about: 1. Facebook paying security researchers to find and report vulnerabilities. 2. Facebook paying (in user data, public image, and lawsuits) for vulnerabilities exploited by malicious security researchers. It's the former. As such, it reminds me of the "What does $1265 of bugs look like?" discussion recently at http://news.ycombinator.com/item?id=2927914 http://news.ycombinator.com/item?id=2927914 , where the author of open-source software paid between $1 and $50 for various bug levels. Does it make any sense for a company like Facebook to offer tiny bounties on code style, spelling errors, and harmless bugs?