3 ms·

You might also want to check if the company has a bug bounty program. Unlikely but worth looking...

• LinuxBender 4y ago
  Adding to this, when publicly disclosing after the grace period it may be safer to let a high profile security site [1] do the public disclosing so they receive most blow-back from the vendor. Krebs is no stranger to drama and could refer to you by your security researcher nickname that is not used anywhere else. Some of the less reputable shoddy IoT manufacturers may respond poorly to public disclosure. [1] - https://krebsonsecurity.com/ https://krebsonsecurity.com/
• mrtweetyhack 4y ago