Thread How to report a security bug?

8 messages · 12:15–17:40

How to report a security bug? I emailed the company, got no response for a week, I then called them and an operator told me they would call me back. I then got a call from one of their technicians, I told them about the security bug and they said "those systems are outdated, we are going to replace them completely soon". Until then, all their sensitive information is exposed, it seemed very odd to me that they don't care about it. Should I call again? Or I was thinking, maybe I should make it more dangerous and threatening?

12:15

A
Aslekar
is the program you reported hackerone or bugcrowd, or is it an external program?
15:29
1. M
  Mohsen HN
  It's an external program. Stores sensitive medical information about people.
  15:43
  1. A
    Aslekar
    and I'm guessing it's an iranian program?
    16:22
  2. A
    Aslekar
    you should not expect to pay a bounty from foreign programs, especially Iranian ones, unless that site itself has a bug bounty program.
    16:24
A
Aslekar
never threaten anyone or speak to anyone in a threatening tone, because you will end up hurting yourself.
16:21
1. M
  Mohsen HN
  I actually was very calm and explained the Bug to the person, he acknowledged the bug, but said that are not doing anything about it, as it's being replaced in the near future. I know the risk because it's about very sensitive information, yet I'm surprised of their reaction. Yes it's Iranian program, and yes I may have expected a bounty or something, but they didn't care.
  17:26
  1. A
    Aslekar
    for Iranian programs, you should only use reputable programs such as Bug Dasht and Bug Bounty Soton, or any program that Bug Bounty offers.
    17:40