I can't explain this any better than the answers here: https://security.stackexchange.com/questions/13760/found-security-vulnerability-what-should-i-do https:/

I can't explain this any better than the answers here: https://security.stackexchange.com/questions/13760/found-security-vulnerability-what-should-i-do https://security.stackexchange.com/questions/13760/found-sec... TL;DR; What you have done can be considered illegal in many countries, US included. I'd consider what you did grayhat hacking (you were not requested to do a pentest, you want to do the right thing, you possibly didn't inflict any damages). Yes, using your real name to report it to the company could put you at risk. If you want to do this sort of work, look for bug bounty programs and abide by their rules (each program has different rules, what you're allowed to probe, etc). If they repeatedly ignore you, it means you already made the mistake of contacting them in the first place. Count yourself lucky and move on. Do not under any circumstances publish how to hack this company on a blog. If you want to contact the authorities because you think there is a great risk to society, do so anonymously. IANAL. Good luck.