My toxic relationship with Meta's bug bounty program
Every relationship starts with good intentions. On October 9, I created my first Facebook account for one reason: to report a security bug to Meta. Within about two hours, the account was permanently disabled. I did the video selfie verification they asked for. That felt fast for a relationship that was two hours old. My appeal was rejected anyway. Here is the catch: Meta's bug bounty portal…
This story explores the author's experience with Meta's bug bounty program, specifically its relationship with the mvfst open-source QUIC implementation. On October 9, the author created a Facebook account to report a security bug to Meta, but within hours, the account was disabled. Despite contacting Meta's security and bug bounty teams, no substantive replies were received.
A GitHub issue was opened, and after 15 days, the fix was released. Meta's engineering team acknowledged the fix and confirmed the bug was resolved. However, the author still cannot access their report, indicating a process issue rather than a personal offense. The author emphasizes the need for alternative methods for researchers to report bugs, as the only avenue currently is through a social media account.
The bug, which allows attackers to bypass QUIC's integrity checks, is now fixed, but the author remains concerned about the inability to access their security report.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
