I applaud him for his expertise and finding the bug but here are some points Ḱhalil: - You violated Facebook's terms of service by exploiting the bug on Sarah's profile. You shouldn't have done that. - I understand that English is not your first language and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken…
> - I understand that English is not your first language and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps. For example you have said "mark profile" instead of "Mark Zuckerberg's profile". That's just ambiguous language and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously.
The part where Khalil writes "mark profile" is the way it is said in Arabic because Arabic has no capitalization. There is no "apostrophe + s" in Arabic either.
The violation of TOS is a obviously a violation, but the language barrier thing again. The TOS is not in Arabic.
Finally:
> - Just because they fail to receive your bug report does not make it ok for you to go ahead and exploit it.
The word "exploit" is not the right word here. He didn't exploit the bug, he demonstrated it, albeit in a poor way but it wasn't an exploitation.