In 2017 Facebook's recovery login form has a bug. At first glance, nothing special. They ask you to enter your phone number, then show you your profile PICTURE and account NAME.
https://www.facebook.com/login/identify/?ctx=recover&ars=fac...
Then I asked myself a simple question "What if...?" Facebook has around 2 billion monthly active users in 2017. This was roughly about 1/4 of the human population. "What if...I make a BOT to create RANDOM phone numbers and it starts making requests to Facebook's servers to reap their user phones, profile photos and names from their database?" Their users are so many that I will always hit a number sooner or later if there is no protection system against automated requests.
Guess what? I start to reap phone number after phone number of their users and Facebook had no proper protection against automated bots requests :-)
Carefully considered synchronized bots attack on Facebook servers and soon you will have the phones, picture and names at least of 1/6 of the earth population. How much will this information cost?
But I was moral enough (and dumb) to provide them with information about this SECURITY bug on the proper channel and Facebook technical support. 'That would at least bring me a few thousand dollars' I thought naively then. After all, information about this bug was sent to them according to all their rules for "Bug Bounty", I have not retrieved information about their users except to verify this security breach... I even sent them Python program code with which they can see for themselves how it retrieve phones from their database.
Not only did they not pay me a penny for bounty reward - they didn't tell anyone about this security breach in 2017 - they quietly fixed their "login form" so that this bug can no longer be used and exploit.
This happens when you try to be moral and there are crooks in front of you.