[xmodem]

At a certain level the question is academic, and lawyering over definitions only distracts from the bigger picture. I trusted Facebook with my mobile number. They permitted bad actors to mis-use their service, and now bad actors have that number. Facebook should be held accountable. Whether it was through SQL injection or a poorly-thought-out API is academic.

[_carbyau_]

SQL injection = Bug-in-computer-code poor API = Bug-in-thought-process

Bug owned by FB either way.