If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.

  • Some big companys make bug bounty programs.Other statements are not important for that company.
    – dgn
    Jan 4, 2014 at 14:00
  • 1
    If they're not offering a bug bounty, then the only way to get them to pay you money for the information is technically called 'blackmail' or 'extortion'.
    – Shadur
    Jan 4, 2014 at 16:02
  • @Shadur : this is not "legal" nor "decent way", the question is pretty clear
    – elsadek
    Jan 4, 2014 at 16:17
  • 3
    That was my way of pointing out that unless there is a bug bounty, the only 'decent' or 'legal' way would be to simply inform them that they have such and such vulnerability and not ask for money at all.
    – Shadur
    Jan 4, 2014 at 16:47
  • 1
    You can offer to sell the information about the vulnerability to them, but be careful how you word it because if it comes off something like "If you don't pay me $xxxx for this vulnerability, I'm going to release it to the world", that could be construed as illegal extortion. You'd probably need a lawyer to draw up a contract, because they probably aren't going to pay until you tell them what it is, so you'll want to make sure they don't brush you off after you reveal it.
    – Johnny
    Jan 4, 2014 at 21:37

3 Answers 3


There is no guaranteed safe solution for dealing with found vulnerabilities. There have been recent cases where researchers have been threatened with prosecution simply for reporting a simple URL vulnerability to a bank. The bank accused them of hacking, because it was a violation of their TOS to attempt to manipulate their URL.

They are under no obligation to deal with you. They did not contract with you to search for vulnerabilities. So don't expect much in the way of cooperation.

Consider using a third party remailer to contact them. You could anonymously offer them the vulnerability, along with a code word, then approach them later after they agree not to prosecute.

You could also approach them through one of their vendors. If you see that their site is hosted on IIS, you could contact Microsoft's security team instead of the organization.


The only 'decent' way to make money off of found security bugs, unless you were contracted to do so in advance, is through 'bug bounty' or similar programs. If you contact a company to inform them of the bug and request money before telling them, you will quite likely be in legal trouble for extortion.

There is really only one way I have seen in which you could possibly prevent the extortion claim. That would be to give them a signed NDA, basically saying that you will not release information on the bug to anyone other then them, even if they decline your offer. The offer being that you give them info on the bug if they chose to pay you, otherwise you take it to your grave. But this would still be a tough go.

It's likely better for you to release the information via normal methods, professional security mailing lists, etc... Get your name out there as a security researcher, get more contracts, etc.

Edit: as pointed out in the comment, I didn't mention third party programs, i.e. zerodayinitiative.com which depending on what you've found, would certainly be worth looking into.

  • You might also mention ZDI... and just plain offering to sell it to them... and offering it to them as evidence of skill in an effort to get a pen test engagement...
    – atk
    Jan 4, 2014 at 18:38

It's simple, call them, ask about what you are trying to report.(If you can't find anything online about a bounty or reward for bug-reports of some sort)

Ask them if they'll have some program of that kind of stuff, if they say NO, well your only way is contacting someone who can change this, like the "president" of the company (just speaking out of my head).

But, bug-reports all applications and web services have... if you'd found an exploit, that would be a different thing, and most big companys award big money for that, (google, facebook and so...).

If you could post what company exactly, it'd be more helpful because that kind of things depend in each and everyone of them.

  • Posting any details of a case -if it does exist- would jeopardize the exploit, my intention is to find out what are standards/protocols to do business with vulns in the legal way
    – elsadek
    Jan 5, 2014 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .