10-year-old kid finds flaw in Instagram, Facebook hands him $10k

MENLO PARK, CA - JUNE 20: Facebook CEO Mark Zuckerberg speaks during a press event at Facebook headquarters on June 20, 2013 in Menlo Park, California. Facebook announced that its photo-sharing subsidiary Instagram will now allow users to take and share video. (Photo by Justin Sullivan/Getty Images) less MENLO PARK, CA - JUNE 20: Facebook CEO Mark Zuckerberg speaks during a press event at Facebook headquarters on June 20, 2013 in Menlo Park, California. Facebook announced that its photo-sharing subsidiary ... more Image 1 of / 3 Caption Close 10-year-old kid finds flaw in Instagram, Facebook hands him $10k 1 / 3 Back to Gallery

A 10-year-old Finnish boy found a way to get Facebook CEO Mark Zuckerberg's attention.

According to Finland news site Iltalehti, the child named Jani (whose last name has been withheld) somehow managed to sneak into Instagram's servers (the company is owned by Facebook) and delete text posted by other users. According to reports, he demonstrated this bug by deleting a comment on a test account.

A true hero, Jani also added that he "could have deleted anyone's [comments] – like Justin Bieber's for example."

Facebook's response to the report? A big cash payout.

Facebook's Bug Bounty, a program that gives cash rewards to anyone who finds and reports "vulnerabilities" in Facebook's (and by extension, Instagram's) services, gave the boy $10,000 for his work.

The bug Jani found was fairly serious for the network. Generally, if you use Instagram and are attempting to delete a comment you wrote, the network's API (application program interface) is supposed to check that you have the authority to do so. However, as the young Finn found, it wasn't always doing that.

"That checking process wasn't working properly," Facebook spokesperson Melanie Ensign told The Washington Post. "You're only supposed to be able to delete comments that you own."

As Ensign continues, the boy's methodology for finding the flaw was completely ethical, too: he had no malicious plans for exposing the issue, and he didn't even have to violate Instagram's terms of service for the discovery, which necessitates Instagram account holders be at least 13 years old. As Facebook revealed, Jani didn't need an account to delete comments, and if he had one, he might have even forfeited his claim to the cash reward.

Everyone, save for Jani, was shocked. Even the boy's father Marko told the local paper that it was "a total surprise that [my son Jani] has gone this far with it."

And as for what's next for the little genius: some sweet new wheels — well, a bicycle — soccer gear, and new computers for him and his twin brother.

Instagram has not responded to SFGATE's request for comment.

Alyssa Pereira is an entertainment and pop culture writer for SFGATE. Follow her here on Twitter.