While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. Basically, the whole idea to build an anomaly detection system was to apply for a job for that webservice and to provide my preliminary solution.
After finding this vulnerability I am thinking to apply there not only with a CV, but also with the detection system and explaining vulnerability as well. But here is a thing: I remember reading about a guy who found a problem in Yahoo! reported it and got rewarded, tried this with Facebook and got jailed.
Because I think that jail is not the best place for me, I would like to ask what are the chances of being charged with a crime?
To keep in mind
- I am not working for that company
- my main objective is to finish my cheat prediction classifier
- the only passwords I tried to break were the passwords of my own dummy accounts
- I want to work for that company
P.S I think that I did not make myself clear. I am working on a classifier to give a prediction, whether the person is cheating in the game or not and because this is a big problem for that service - I am planning to apply for a job, having this classifier as an additional plus for my CV. I accidentally found a vulnerability and thinking whether I should report it or no, and if yes, what problems can I face. It is going to be something like this, "here is the problem and here is what I think you should have done. If you want, I would like to work for you, but not as a security specialist (I do not have knowledge for this), but as a data-miner". Whether they will take me or not, I basically do not care.
It has nothing to do with the scenario: "I want to work for you and I know how to get a password of a user, so think twice before rejecting me."