Ask HN: Found security flaws but vendor seems not to care. What should I do?
IMO, post to the Full Disclosure mailing list[1]. I&#x27;d do it anonymously if worried about legal action, but sign the message with a new PGP key. That way I can claim the discovery later if that becomes advisable.<p>[1] <a href="http:&#x2F;&#x2F;seclists.org&#x2F;fulldisclosure&#x2F;" rel="nofollow">http:&#x2F;&#x2F;seclists.org&#x2F;fulldisclosure&#x2F;</a>