Any particular reason you didn't report this through facebook.com/whitehat after googling how to report security issues to facebook? Or attempt to reproduce it independently after reading instructions for best practices when doing so on the aforementioned page? I can only assume it's because these patterns and facilities weren't within your awareness at the time, which is fine, but ideally you may consider these both in the future.
I point this out not only because this kind of blast looks bad (even among full-disclosure circles), but because if it's a valid find, you just passed up potentially a five figure sum.
I point this out not only because this kind of blast looks bad (even among full-disclosure circles), but because if it's a valid find, you just passed up potentially a five figure sum.