There were a couple of occasions quite some time back (circa 2010) when I reported issues to e-commerce sites: - trivial enumeration attacks that could be used

There were a couple of occasions quite some time back (circa 2010) when I reported issues to e-commerce sites: - trivial enumeration attacks that could be used to retrieve customer information (name, address, order, payment details, ...) - XSS issues that could be exploited by sending crafted URLs to customers In all cases, I received rather lame responses as if the person in question was completely nonchalant about the issues. All I could do was to avoid those stores myself.