I recently came across the following article.
Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team.
What particularly caught my attention was the fact that the team decided to not act on the report because they allegedly didn't have enough information to reproduce the bug, and hence simply replied "this is not a bug."
Also, this is the first time I came across such case in the news, yet it doesn't seem like an isolated event. That is, I have a feeling that this happens way more often.
How do teams decide when a report is not "actionable enough"? Does it happen often?
Are there other famous cases like the one above?