security penetration testing facebook bug bounties remote code execution ethics