Short & sweet post by Facebook on handling a security issue. They seem genuinely interested in thoroughly fixing it. https://www.facebook.com/BugBounty/posts/778897822124446