I recently purchased an item directly from a brand # (in comparison to amazon or resellers) and found an IDOR that gave access to all their invoices. I didn’t blog about it, didn’t go to the media, didn’t “@“ company to DM me. I just emailed their support@ & DM’d then on Twitter

I started the email with “I’m not doing this for compensation or to threaten your team, I just want to make sure my PII stays safe” and sent them the details and luckily heard back from them within a few days.

If you accidentally find a bug, don’t be a dick. When you go to the media and make a scene, the engineers don’t deal with the whole thing.. you’re also causing extra work for their PR teams and people that had nothing to do with the vuln.

If they’re not inviting you to look at the products, you shouldn’t be poking at them and then get pissed off that you didn’t get a shiny star for something you shouldn’t be doing in the first place.