Yes it is complete bullshit. This account is full of minimizing Facebook's role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works).
> His account on our portal mentions Synack as his affiliation
Note 'his account' here is just his Facebook account. So you can rewrite that line as 'his Facebook account lists him as employed at Synack'
> he has interacted with us using a synack.com email address
That would be a crazy new precedent if we use email addresses as authority
> and he has written blog posts that are used by Synack for marketing purposes.
having written blog posts is even crazier.
Were Alex genuine in thinking this was Synack he would have copied Wes on the email and/or he would have asked him. He straight up went behind his back and over his head.
Facebook had a bounty program that was very respected and operated well. I don't understand how they've completely fucked this up and turned it into a pissing contest.
Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with.
This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake.
I really, really don't get this.
edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real/public name. avoid blowback, everyone gets it at least once.