There were also SSH key files.

I’m not publishing the archive, keys, or session logs.

I submitted the report and findings using Meta’s bug bounty program. Meta marked the report “Not Applicable.”

Guess they don’t care if you publish the SSH keys then?

Time to try and convince it to set up a reverse SSH tunnel

Soo, was that incompetence, negligence or misled belief, trust?