I think what is normal is to let the company know first. And also give them a test they can reproduce with the bug and also a deadline in which you are going to

I think what is normal is to let the company know first. And also give them a test they can reproduce with the bug and also a deadline in which you are going to make public the security bug you have done. The deadline is because many companies ignore the problem until is public. This opinion comes from reading this Chris Shifflet's article: http://shiflett.org/blog/2007/mar/my-amazon-anniversary http://shiflett.org/blog/2007/mar/my-amazon-anniversary "On this day last year, I informed Amazon about a pretty serious vulnerability and demonstrated it with a few examples and a detailed description. In the description, I explained how to exploit the infamous "1-Click" feature, causing victims to purchase items of my choosing without their knowledge or consent, and I stressed that the scope of the problem extended beyond my benign examples. After some mild prodding, I finally received a reply letting me know that my email had been received, the vulnerability had been verified, and Amazon considered fixing it a top priority.""