> I assume it would still go a bit wild, but have the least negative impact. Which is why I added this. It will not be a smooth experience. But the OP will sti

> I assume it would still go a bit wild, but have the least negative impact. Which is why I added this. It will not be a smooth experience. But the OP will still be in a better position than the current one IMO. You tell me who looks MORE suspicious. - A guy who found a vulnerability and reported very soon and hence the effected bank know about it soon. Or - Or when the effected bank finds out after A COUPLE OF MONTHS (even a few weeks after) that their competitors employee found a vulnerability and they still haven't heard about it? Keep in mind the added issue of the employee being from a competitor and that they might have already seen abuse of the vulnerability which might not be done by the OP. But since it is delayed, all of it is in the OP's shoulders.