I imagine FB requests that details of the vulnerability are kept private until they have informed the discoverer that they are happy for it to be published.