Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sitesReporting vulnerable sites
I've found a security vulnerability which gives me the ability transfer money to my account.
What should I do now? Do I get payed by the company where I found the bug? Should I report that bug to them before they tell me how much they pay me for that bug or after?
Should I write to the Customer care or the Sales mail address of them? And what should I tell them anyway?
Am I allowed to share the existence of that bug without providing details?
The problem is that I'm a minor so I don't know anything about all this and I've also the fear that they don't believe me because of my age.
What I ended up doing: I just sent them a mail with the bug and didn't tell any adult about this at the time. The fixed the bug pretty fast and gave me a really small bounty worth around $200 at that time.
What I would do today: Now that I'm not a minor anymore (ohh my I've gotten old). I'd contact them through a penetration testing company or something similar and ask them if they'd be interested in us checking their system. Telling them that they wouldn't have to pay anything if we wouldn't find anything and disclose the bug through that. If they refuse, they usually don't if done right, I'd get in touch with them anonymously and disclose the bug.
