Title: It has recently come to my attention that my largest competitor (B2B SaaS in a niche market) has blatantly disregarded all PCI regulations for close to a decade.<p>He uses a multi-tenant database, stores CC numbers in plain-text (full 16 digits, CVV and Expiration Date), and shows that data to the user, in plain-text, at the time of payment.<p>I discovered this in the process of helping a new customer export their data from the old system.<p>I&#x27;ve spent days debating the ethics of reporting or making this public. On the one hand, I&#x27;d be putting him out of business (and I&#x27;m well poised to scoop up those new prospects). On the other hand, he&#x27;s putting people&#x27;s finances at risk and I feel obligated to say something that the public may not be able to discern.<p>Any advice would be greatly appreciated.
Upvote: