For starters, the ethics of vulnerability disclosure are such a broad subject, you're going to get 10 very different answers. A generally common approach is:

For starters, the ethics of vulnerability disclosure are such a broad subject, you're going to get 10 very different answers. A generally common approach is: * try to contact them via phone/email * if no response, contact a CERT and see if they care * wait a while (90 days? 3 months? up to you) * if no response; disclose publicly Asking for money? big nope. If you genuinely want to have this problem fixed, get it fixed. If you want to make money from finding bugs, enter bug bounty programs. Please don't try to manipulate them into giving you money, it only serves to deeply hurt the reputation of people working in the often very difficult field of vulnerability research and disclosure. Edit: bullet points not working. Edit2: be careful with the way you report these vulns. If you've tampered with variables in an API for example, that could constitute 'hacking' and they may come at you will full force and lawyers. In that case you may want to use a proxy (a human proxy).