Reading local files from Facebook's server (fixed) (opens in new tab)

Neither here nor there regarding compensation, but if I were to describe this for the purpose of e.g. a resume, I do not think "I demonstrated a vulnerability allowing one to root a facebook.com server and thereby compromise any Facebook user" is an exaggeration. You're most of the way there, and while developing it further might be a fun exercise, from their perspective it should be a mostly forgone conclusion that you'll win.

In my experience - yes. Very generous.

Almost all other companies would say the bug was out of scope, thank you for reporting it, and maybe send you a t-shirt.

Did you report it to Facebook, rather than sell it on the market? Yes? Then it was enough, by definition.

Honestly, resume uploads are unlikely to be worth much. The resume analysis software either. What information there is worth anything to an unreputable buyer?

Yeah. In the 1 day timeframe between temp and permanent fix you could not upload resume, which is a breaking change for end users.

But, I think it was pushed because it was Sunday and Careers team was not on site to properly/permanently fix the bug.

It's most likely for the Gopher protocol: http://en.wikipedia.org/wiki/Gopher_%28protocol%29

I'm more suprised at all the useless users still present.