4 ms·

That sounds akin to extortion... Edit: I should probably expand on that. Telling a company that you know about a bug but won't tell them about it if they don't

That sounds akin to extortion... Edit: I should probably expand on that. Telling a company that you know about a bug but won't tell them about it if they don't pay you and instead threaten to turn it over to other parties who may have more nefarious intentions is pretty much extortion and is likely illegal. I understand that you'd want to make money out of it, but if the company offers no bug bounty, it's no good threatening them. If you do so, it'll likely trigger a hostile response.

darrhiggs 12y ago
Exactly. That's how I thought it sounded. But is it my responsibility to spend time reporting this to them? Should I leave the vulnerability for others to take advantage of, if they come across it? How do I know that others aren't already doing so? With this specific vulnerability it could be used it to build an address book of emails, {home,work}addresses, telephone numbers etc; given the nature of the app.
darrhiggs 12y ago
Reply to your edit: Thanks. Maybe the xxx.org came across wrong. My intention was a government organisation, nothing nefarious.