Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger. Unless the company concerned has a well d

Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger. Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking. What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has 2 options, admit it was their fault and the vulnerability exists and risk being accused of incompetence, or say that the system was hacked. Human nature being what it is, one tends to complain of being hacked, thus snow-balling effects, which lead to the arrest of an 18 year old just trying to help. My advice: Don't report these types of bugs at all, or if you really feel you must, report anonymously.