This question already has an answer here:
I was collecting sites that use a system we're going live with. Just URLs and nothing more, so we can see what others have done with the same system to give us ideas.
Since I know how the system works, curiosity got the better of me. We whitelist our deployment so I went through a few and noticed their admin sections were not whitelisted.
At this point, I just thought "hmm, interesting". A password prompt comes up and I just put a random admin/password without any thought and I actually got in.
I realise the
without thought part might come back to bite me. I want to disclose this to the company but not sure how I should go about it. It's a multinational brand. I havetried reaching out to them via email and Twitter but still nothing back.
Any advice? Do I just do it anonymously? Would it be useful to publicly disclose at some point?