Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert them about this problem. But it would be nice if the company let me solve the problems that I identified as freelancer or something. But probably they will contract some security company to do this job and pay an higher monetary value.

Any advice about this subject? What should be my ethical approach?

share|improve this question

closed as primarily opinion-based by Xander, tylerl, Noordung, Lucas Kauffman, NULLZ Aug 7 '13 at 3:19

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
While your topic is interesting, unfortunately there is no absolute right answer; everyone has their opinion. As such, this question belongs instead on a discussion forum rather than this particular Q&A site. –  tylerl Aug 7 '13 at 1:57

1 Answer 1

up vote 6 down vote accepted

The ethical approach is to report, confidentially, and to not combine the reporting with a request for payment to fix it, which could be seen as extortion.

Explain how you found the problem, and possibly include steps to remedy what you found, but leave the fixing to them.

As a Security Manager for an insurance company, I can tell you that I would be grateful to know about the problem, but would shut the door in your face if you started to try and turn it to your advantage. If, instead, you worked with me openly to fix things, helped to retest, and generally was pleasant to work with, I might offer you a job at the end, or at the very least, offer a letter of reference for your skills and professionalism.

In the end, it is THEIR website, and their responsibility to fix, or not to fix.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.