Return to Answer

Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal. I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal. If your actions in discovering the bug violated the law, even arguably, and if you piss off the company or generally act like a jerk (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you for violating federal law. You really don't want to be in that position.

• Reporting vulnerable sites

• How to disclose a security vulnerability in an ethical fashion?

• How should I escalate a vulnerability that is dismissed by the vendor?

• Which companies facilitate payment in return for vulnerability disclosure? (but I doubt they will pay for a vulnerability in a website; there are few or no buyers for that)

But, the bottom line is: check your motives. The only reason to report the vulnerability to the company is because "it is the right thing to do" and for the good of others. You are not likely to make money off this, I'm afraid to say this. If you find that you are doing this for purposes of making money, stop; go do something else. If you are doing this for purposes of making money, the risks are too high that you will find yourself hit with a lawsuit, a criminal prosecution, or something else that not only prevents you from making money, but also makes your life hell. There have been too many other cases where security researchers were prosecuted for "hacking", when they were just trying to report or publicize a security vulnerability (not even try to exploit it for financial gain).

Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal. I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal. If your actions in discovering the bug violated the law, even arguably, and if you piss off the company or generally act like a jerk (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you for violating federal law. You really don't want to be in that position.

• Reporting vulnerable sites

• How to disclose a security vulnerability in an ethical fashion?

• How should I escalate a vulnerability that is dismissed by the vendor?

• Which companies facilitate payment in return for vulnerability disclosure? (but I doubt they will pay for a vulnerability in a website; there are few or no buyers for that)

But, the bottom line is: check your motives. The only reason to report the vulnerability to the company is because "it is the right thing to do" and for the good of others. You are not likely to make money off this, I'm afraid to say this. If you find that you are doing this for purposes of making money, stop; go do something else. If you are doing this for purposes of making money, the risks are too high that you will find yourself hit with a lawsuit, a criminal prosecution, or something else that not only prevents you from making money, but also makes your life hell. There have been too many other cases where security researchers were prosecuted for "hacking", when they were just trying to report or publicize a security vulnerability (not even try to exploit it for financial gain).

It is unlikely that you can make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability.

It is unlikely that you can legally make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability.

Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal. I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal. If your actions in discovering the bug violated the law, even arguably, and if you piss off the company (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you violating federal law. You really don't want to be in that position.

• Reporting vulnerable sites

• How to disclose a security vulnerability in an ethical fashion?

• How should I escalate a vulnerability that is dismissed by the vendor?

The reason I suggest having someone else help you disclose this is because you want someone who has

Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal. I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal. If your actions in discovering the bug violated the law, even arguably, and if you piss off the company or generally act like a jerk (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you for violating federal law. You really don't want to be in that position.

• Reporting vulnerable sites

• How to disclose a security vulnerability in an ethical fashion?

• How should I escalate a vulnerability that is dismissed by the vendor?

• Which companies facilitate payment in return for vulnerability disclosure? (but I doubt they will pay for a vulnerability in a website; there are few or no buyers for that)

The reason I suggest having someone else help you disclose this is because there is a significant opportunity for misunderstanding. You want someone who has worked in business to help you craft the letter, to make sure it is taken seriously, and to make sure the company doesn't treat you as a threat and start coming after you with threats of a lawsuit or prosecution. Big companies have entire legal departments full of lawyers who exist solely to protect the company's financial interests. If they perceive you as a threat, they may use every legal resource they have to try to prevent you from embarrassing the company. Someone with more experience in a business context can help you protect yourself.

But, the bottom line is: check your motives. The only reason to report the vulnerability to the company is because "it is the right thing to do" and for the good of others. You are not likely to make money off this, I'm afraid to say this. If you find that you are doing this for purposes of making money, stop; go do something else. If you are doing this for purposes of making money, the risks are too high that you will find yourself hit with a lawsuit, a criminal prosecution, or something else that not only prevents you from making money, but also makes your life hell. There have been too many other cases where security researchers were prosecuted for "hacking", when they were just trying to report or publicize a security vulnerability (not even try to exploit it for financial gain).

P.S. Here is Dan Kaminsky's informal, not-to-be-taken-too-seriously, summary of how things tend to work today: