URLs in img tag aren’t passed through safe_image.php which lead to exposure of Facebook users IPs.

Logic Flaw: I Can Block You from Accessing Your Own Account

“Like” Bypass on Customer Reviews — €500 bounty

Interesting Business Logic Error leads to Pre-Account Takeover via Verification bypass on GoogleVRP