Hey, good find but I'm a little confused. It appears that you found what could be a serious issue if no other checks are in place; however, in doing so you app

Hey, good find but I'm a little confused. It appears that you found what could be a serious issue if no other checks are in place; however, in doing so you appear to have exceeded the access you were provided through the application to their back-end system. Did this fall under a bug bounty program where you had permission to do this or did the company give you written permission? I was looking for a bug bounty program and couldn't find one. I ask because it looks like you were performing testing which touched their infrastructure, not just your phone and the US Computer Fraud and Abuse act gets pretty scary (Felony scary) when it comes to such things: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act I do a ton of mobile application reviews and find stuff like this quite often but back away at the point I start touching their infrastructure rather than just my phone.