[fancythat]

One point of you to consider though, I guess FB runs pentests all the time, either internally or externally by appointing some other company to do it.

That being said, if they pay that company 35k, for example, and they haven't found this, wouldn't that fact make this discovery worth more than 35k?

[lazyasciiart]

Maybe they found other bugs that were worse, or of the same value, and you should have just given them another day.