With vulnerabilities like these, there is a big problem in my opinion. Who actually ever reports these? The thing with vulnerabilities like describes in the po

With vulnerabilities like these, there is a big problem in my opinion. Who actually ever reports these? The thing with vulnerabilities like describes in the post is that they are SO EASY that you dont need any special infosec expertise. All you need is to be able to install a program and use a REST api I would go as far as to say that this can almost be described as an open database. The API completely exposed anything. But how would Giggle find out about this if not for the OP? Their own engineers were either oblivious to any security practices because they are beginners, or they were ignorant about them (or didnt get enough money to actually care). A company like this will NEVER hire a pentesting company. The kind of company that does actually pay for pentests however, are very unlikely to have vulnerabilities that trivially exploited. Which leaves us with only two groups that will care about stuff like this: Cyber-Criminals and Hobby Hackers. The former will gladly pick that low hanging fruit for them, while the latter has time and time again experienced abuse by the people they reported vulnerabilities to. (Free of Charge of course). What do you do? Drop an anonymous hint at your CERT? Those will get ignored because they are anonymous are they not? Do you give your full name? Thats dangerous too. The case of Alberto Hill[0] highlights this. [0]: https://darknetdiaries.com/episode/25/ https://darknetdiaries.com/episode/25/