How to properly disclose a security vulnerability anonymously?

Question

Let's say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination.

I've reported this within my company and to the company that provides the software but neither really care despite the possibility for major security risks and also legal risks due to this (the software reports production numbers and makes calculations for BI etc.).

I tried the combination with other software products from the same vendor and these also have the same backdoor. How should one proceed in disclosing this anonymously (as I know other companies that use this software) so it won't have consequences for myself which I fear because we have ongoing business relationships with that vendor.

Answer 1

Trying to go trough a third-party might help in this case.

One of the main company in this area is the zero day initiative. You could probably report your flaw to them or another third-party. Depending on the importance of this flaw, you might receive monetary compensation for reporting the flaw.

Those company usually have way more connections and leverage than an average independent person.