Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? Also how can the company "trust" the reporter that the reporter himself has not taken up any "benefit" from that vulnerability.

I have been reading about GCIH, where the instructors guide about the responsible disclosures but it should be first signed and approved that I am authorised to carry out the vulnerability assessment, but does not understand how websites/companies over internet are acknowledging people for reporting issues.

Thanks in advance !

3 Answers 3


Welcome to the conundrum of the security business and why it is more profitable to be a bad guy than a good.

Remember this about "getting sued"... Anyone can sue anyone - even if there is nothing justified to sue over. If an entity has money to sue the entity that doesn't have money to fight it looses, almost automatically. 50% of the time or more, if you get sued for some of these things, you are also having to fight off state or federal (or your country's equivalent) criminal or regulatory authorities at the same time.

This is why insecurity will always reign, and why I am sure no one wants any of it fixed.

Here in the US, if you even inadvertently find an issue and report it to a product owner you could be facing their civil (sue) wrath, you could be facing DMCA and others. What do I mean by inadvertently? I could be debugging what I think is an issue with my local machine acting wonky and decompile, or source code from a 3rd party (where I find the problem). Now remember, they are causing the problem to MY machine and I am trying to figure it out... As soon as I find it, and report it, I could be in this grey area.

And I am not even "hacking" per se.

So the rules have been written badly and poorly to really allow for public disclosure. I think that is why organizations that want bugs and security concerns to be found have create very open and clear "bug bounty" programs and do so with a very "open kimono" approach.

What I have seen work in absence of those, is to do what a lot of researchers do... set up anonymous accounts that you can report the information to the organizations to, and don't take credit for it until well after it has been taken care of - I guess that is unless you are hacking Facebook. Seems like everyone is in Facebook's face hacking it aggressively and publicly :).


If a business acknowledges that security issues have been reported to them by non-solicited penetration testing, they're essentially admitting to having insecure systems publicly available. Additionally, non-solicited penetration testing is an attack on their systems so, while you may be the knight in shining armour for helping them secure their systems and their customers' data, you're also breaking the law and considered accordingly.

There are bodies which exist who can be informed of issues identified on sites and who will inform the site/business owner in a process of 'responsible disclosure'. i.e. inform the owner of the issue and provide them time to resolve, inform them 3 months later if not resolved, go public if no response/resolution.


As you point out, it's more or less a grey area. That being said, if a security researcher discloses a vulnerability to the vendor without causing problems, releasing confidential information, etc., the vendor has no motive to sue or bring criminal charges against the researcher -- wouldn't they want researchers to disclose to them rather than releasing or using 0-day?

(Look up "Weev" for a case that did not go so well...)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .