>2024-03-07: Tried to find information how a vulnerability can be reported to Ariane Systems. The vendor does not use security.txt nor a DNS TXT record for secu

>2024-03-07: Tried to find information how a vulnerability can be reported to Ariane Systems. The vendor does not use security.txt nor a DNS TXT record for security contact lookup. There is no information on the website how to contact the product security team. Therefore, Pentagrid initially contacted Ariane Systems via support@ariane.com. Ugh. I've been in a similar scenario and had to report a security bug via the normal support channel for a fairly large-sized company. Never again. It was significantly more work to get the bug in front of someone who understood it and could do something about it than it was developing the exploit in the first place. After a certain company size it should be a legal requirement to have a dedicated security contact listed somewhere. Now, after a few good faith attempts to get an exploit in front of the appropriate person at a company, I just forget it. I'm sure there are people in similar situations who, after a few attempts to report to the company, end up selling the exploit rather than forgetting it.