Facebook? We're talking about PayPal here. Facebook's vulnerability program requires you just not be in a country subject to US sanctions (and presumably be over 13, the age you need to be to have a Facebook account in the first place).

Sorry, I've been commenting on both companies in another forum and my brain skipped track there.

For any company that offers bounties, my points are still relevant: not handing the out to a subset could encourage that subset to look for reward elsewhere, and the perception of labour use could be an important consideration.

No reason you'd need a Facebook account to find some exploits.

How is it employment if someone simply does some work through their own choice without having any sort of formal employment relationship in place?

I'm not saying it is, just that it might be perceived to be.

Public relations has nothing to do with true facts, it has everything to do with how people interpret the details they see. If someone does mis-interpret and get on their high horse, others will join in without checking the facts themselves and it can be a nightmare trying to point out the truth of the matter over all that noise.

Fair enough.

I think we need to start introducing limits on the height of horses :)

...this isn't facebook

Sorry, I was discussing both companies in another forum just before coming over here. My poor little brain skipped track and had me type the wrong name...