If you are receiving your money or reputation from a platform (like HackerOne) then you are going to be underappreciated, undervalued, and treated like an expen

If you are receiving your money or reputation from a platform (like HackerOne) then you are going to be underappreciated, undervalued, and treated like an expense that should be minimized. Here is what responsible disclosure looks like in 2020 from somebody that has self-worth: > (Message posted to Hacker One, and emailed to any address you can find, and sent in a letter by mail. Yes mail. Also copied in all those ways to investors of the target.) > > Dear Sir or Madam: > > I have learned about a security issue in PayPal's service. This includes being able to login to user accounts without the credentials the system is expecting. [Be vague about how exactly it works, but explain the impact.] > > I am not an employee or contractor of PayPal and I will publish this on my blog at https://privacylog.blogspot.com https://privacylog.blogspot.com to build on my reputation for finding and improving the security of internet systems. > > This post will publish on 2020-03-09, which is two weeks from today. > > If you are committed to fix this issue before public disclosure, I will be happy to work with you. You can contact me at ... --- Key points: - The discussion is about my reputation and values. - I am not demanding any payment (not sure if that is legal). - Set a firm publish date. - This asks them to make a commitment to fix and frames the discussion going forward. And if they do not get back to you, then when you publish you explain it just like you see in newspapers: "the vendor failed to respond and act on this report when I contacted them by email, social media and paper mail with two weeks' notice".