I once got a parking ticket, and I was trying to figure out how to pay it online. I found a site for the city that I was supposed to put in my license plate num

I once got a parking ticket, and I was trying to figure out how to pay it online. I found a site for the city that I was supposed to put in my license plate number and my date of birth to look up a parking ticket in order to pay it online. I realized that the car was registered to one of my parents, honestly I wasn't sure I had their birthdays exactly memorized, and I couldn't contact both of them at that very moment, so I tried guessing a few dates for the birthday field. I got frustrated, and ... well I've participated in a number of security CTF challenges / puzzle games, where SQL injection is a common technique you're expected to do, and step 1 of many CTF challenges is to literally put the following characters into each text field you find: ' OR 'A'='A It's like the SQL-injection version of "open sesame". It's generic, fitting a common coding mistake, not tailored to any specific site. It's a force of habit to use while working on CTF challenges ... Desperate to solve my problem of finding my own parking ticket, I reached to that knowledge without really thinking about it and used it. It worked, and the page showed me hundreds of parking tickets with people's full names, license plate and driver license IDs, addresses, and ticket amounts and descriptions. (A glance showed a few people were racking up thousands of dollars of parking tickets, seriously wtf?) I worried about what I did and closed the site. (Well first I scrolled through the list to see if my own parking ticket was there. It wasn't. Turns out where my parking ticket was given was actually in a different city; I was checking the wrong site to begin with.) I thought about reporting it, but given that I already exploited it and saw private information, I thought twice. I've reported security issues at sites before, but never at a government site or involving me having seen people's private information. I got panicky and just closed the site. I don't owe them the report and the risk it puts me at. It's a nice thing I do for people who invite it or when the risk is low, but somehow I think legal actions are more likely from the site for a local court. If anyone owes anyone, it's the developers for risking people's information so carelessly and for putting me into this type of bind, but somehow I think if I reported this I think I'd be the only one at risk of being treated as a criminal. I'm not fully sure why I felt compelled to think this was all relevant to this thread. Maybe just to illustrate some of the stress that comes from the vulnerability-reporting side of things. If you want secure systems and for people to report issues as they see them, then sometimes you need to invite the reporters. The difficulty described in the article of even reporting the issue makes me think I'm probably very far from alone in avoiding reporting this type of thing.