Off the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify.

Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a real finding.