Talk to a lawyer too. By posting this you no longer have plausible deniability in the event something bad happens down the road. For example, maybe your client

Talk to a lawyer too. By posting this you no longer have plausible deniability in the event something bad happens down the road. For example, maybe your client is hacked and an investigation is opened by the credit card company who finds out that you had discovered gross negligence on the part of your client but had not reported it. I'm not sure if that opens you up to the chance of being sued. Somebody might have their identity stolen or the credit card company might want to recoup some costs. Maybe the client turns on you and somehow makes you a scapegoat. Simply by posting this story, you may have opened yourself up to a lawsuit because an enterprising mind could follow your HN history and what you've posted here, put together enough clues, and find out the vulnerable system. They could hack it. No, you weren't directly responsible for it, but civil law is an entirely different beast than criminal law.