Companies that have security pages and contact details are also companies that understand the importance of security issues. the problem here is that most compa

Companies that have security pages and contact details are also companies that understand the importance of security issues. the problem here is that most companies do not understand the issue and tend to react defensively One solution might be using an agent - setup a clearing house for security issues run by a couple of trusted people. You log the issue, the clearing house gets in touch with the company and gives them access to the issue details. It keeps the person reporting the issue one step away from the company and any potential trouble. Once the company acknowledges and fixes the issue it is made public with an optional credit If they don't acknowledge the issue it becomes public anyway after x days.