I was surfing on a big company's website, and I tried to make an account on it. I found that the account registration was quite buggy so I checked the page source. I found that there were error logs generated by an index.js file. The index.js file was publicly accessible with a very easy url addition (assets/index.js). The js file contained API endpoints to the backend. I clicked on one of the API urls and found out that the backend was using django framework, and was running on debug mode.
I was able to access the server's /admin login page.
I tried putting in
admin for username and
admin for password and it worked. I got access to the django admin portal, which had all the user data, also was able to find out the AWS tokens which were being used to upload/download data from the database.
What should I do? I know that password guessing is illegal so I can keep my mouth shut about it, but if I, as a newbie was able to access it, I am pretty sure that it'll be a piece of cake for experienced hackers. How do I report it?
Edit: Is there any way I can ask for a bounty or some kind of reward :D