[dandyhighwayman]

This is crap and you're embarrassing yourself and Facebook.

You all are lucky that people are sharing this stuff with you guys for $500 instead of on the black market for much more. You're also lucky that people are doing the job that highly-paid Facebook engineers should have done. And if I read between the lines of your post, you and your team think that you're pretty clever.

The right thing to do is to cut this guy a check for $500 and keep your mouth shut, before people stop reporting security bugs to you.

I know I'm already discouraged--if I find anything, the last thing I want to deal with is a mediocre engineer telling me I didn't fill out the TPS form the right way.