Return to Answer

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If you do not get a satisfactory response, pass this information on to their boss.
   (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

• This may lead to a successful attack by individual(s) with poor intention.
• In many jurisdictions, there are legal attacks that companies can impose on individuals in your position.
• Such publication can promotes a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose the vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If you do not get a satisfactory response, pass this information on to their boss.
   (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

• This may lead to a successful attack by individual(s) with poor intention.
• In many jurisdictions, there are legal consequences that companies can impose on individuals in your position.
• Such publication can promote a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose a vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If no response, pass this information on to their boss.
   (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

• This may lead to a successful attack.
• In many jurisdictions, there are legal attacks that companies can impose on individuals in your position.
• Such publication can promotes a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose the vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If you do not get a satisfactory response, pass this information on to their boss.
   (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

• This may lead to a successful attack by individual(s) with poor intention.
• In many jurisdictions, there are legal attacks that companies can impose on individuals in your position.
• Such publication can promotes a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose the vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If no response, pass this information on to their boss.  (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

You should not disclose the vulnerability publicly. In part because this may lead to a successful attack.

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

I think that publishing a vulnerability on your own accord is not a productive thing to do. There may be some cases where it is an appropriate last-resort, but I would highly recommend you defer the responsibilities of doing this correctly and without bias.

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours.

1. Take an extra step to disclose your proof of vulnerability to the owners of the site.
   (i.e. verify they are receiving your communications)

2. If no response, pass this information on to their boss. 
   (higher rank in company, or parent company)

As others have said, be courteous and professional. This will help you to gain credibility. You should start with a simple human explanation (just the facts), and in the same email you should include the technical details. (so the company can verify your findings before reply)

If all avenues fail, I would encourage you to pass the evidence on to the responsible public service (one poster suggested CERT), however I am not experienced in this.

You should not disclose the vulnerability publicly.

• This may lead to a successful attack.
• In many jurisdictions, there are legal attacks that companies can impose on individuals in your position.
• Such publication can promotes a poor balance of responsibility between the attacker and the defender.

I concede that there may be cases where it is right to publicly disclose the vulnerability, but I would highly suggest you defer such responsible, careful, and unbiased handling to a public service that is more experienced in such matters.