{
  "id": 18357083,
  "title": "My toxic relationship with Meta's bug bounty program",
  "url": "https://urgent.news/2026/11/05/my-toxic-relationship-with-metas-bug-bounty-program",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T19:26:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/zerox80/my-toxic-relationship-with-metas-bug-bounty-program-3f9c"
  },
  "original_language": "en",
  "account": "This story explores the author's experience with Meta's bug bounty program, specifically its relationship with the mvfst open-source QUIC implementation. On October 9, the author created a Facebook account to report a security bug to Meta, but within hours, the account was disabled. Despite contacting Meta's security and bug bounty teams, no substantive replies were received. A GitHub issue was opened, and after 15 days, the fix was released. Meta's engineering team acknowledged the fix and confirmed the bug was resolved. However, the author still cannot access their report, indicating a process issue rather than a personal offense. The author emphasizes the need for alternative methods for researchers to report bugs, as the only avenue currently is through a social media account. The bug, which allows attackers to bypass QUIC's integrity checks, is now fixed, but the author remains concerned about the inability to access their security report.",
  "summary": "Every relationship starts with good intentions. On October 9, I created my first Facebook account for one reason: to report a security bug to Meta. Within about two hours, the account was permanently disabled. I did the video selfie verification they asked for. That felt fast for a relationship that was two hours old. My appeal was rejected anyway. Here is the catch: Meta's bug bounty portal…",
  "key_points": [
    "Author created Facebook account to report security bug to Meta.",
    "Account disabled within hours, no response from Meta's security teams.",
    "Fix released 15 days later, author still cannot access report."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}