Facebook opens up on System that ‘protects Billions’

Facebook describes its defensive security program, including mandatory secure development training, use of safe coding frameworks (Hack, XHP), static and dynamic code analysis, custom vulnerability scanning, internal red teams, threat modeling exercises, and public/private bug bounty programs; the piece notes a past vulnerability that required resetting millions of accounts but focuses on organizational controls rather than a specific ongoing attack.