Return to Answer

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that then my only suggestion is: "STOP!".

##What you shouldn't do##

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

##What you should do##

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

##tl/dr:##

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that then my only suggestion is: "STOP!".

What you shouldn't do

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

What you should do

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

tl/dr:

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

##What you shouldn't do##

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

##What you should do##

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

##tl/dr:##

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that then my only suggestion is: "STOP!".

##What you shouldn't do##

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

##What you should do##

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

##tl/dr:##

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

##What you shouldn't do##

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

##What you should do##

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have an established security team then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

##tl/dr:##

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

##What you shouldn't do##

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

##What you should do##

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

##tl/dr:##

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.