Title: While fooling around with Fiddler looking at data going in to and out of my phone, I discovered an application with a serious data leak.<p>The leak includes customers private and personal information such as height, weight, address and phone numbers including that of my wife.<p>No one seems to take the data leak seriously and it is a simple IDOR on their API.<p>While I had thought about probing deeper, I did not want to get tangled up into any legal trouble and stopped immediately.<p>I have been unsuccessfully trying to contact anyone at the company that will listen.  I have Tweeted, Emailed and tried calling the contacts I see available on their main page and developers on LinkedIn and I received one reply from an automated ticketing system and no call back from my voicemails.<p>Is there an easier way to disclose a vulnerability like this without risking legal actions? The company is not on HackerOne and I feel that when a young company receives news like this they will either go on the attack or respond in kind.<p>Is it worth just forgetting the whole thing removing my accounts and moving on?
Upvote: