I found a vulnerability. they found a lawyer (dixken.de)

Article summary

A diving instructor and platform engineer discovered a critical vulnerability in a sports insurer's portal, which exposed sensitive personal data due to predictable user ID enumeration and a static default password. The engineer disclosed the vulnerability to the organization and the relevant authorities, but the organization responded with legal threats and attempts to silence them. The vulnerability has since been fixed, but the engineer is concerned that affected users may not have been notified. The incident highlights the challenges of responsible disclosure and the importance of prioritizing user data protection over reputation management.

Main themes

• Responsible disclosure
• Vulnerability management
• Data protection
• Reputation management
• Security best practices

What commenters say

• The process of reporting security vulnerabilities to companies is often flawed and can put the reporter's career at risk.
• Companies often prioritize reputation management over user data protection and may try to silence security researchers who report vulnerabilities.
• A third-party non-profit organization could provide a safer and more effective way for security researchers to report vulnerabilities without fear of retaliation.
• The current system of reporting vulnerabilities to companies directly can be ineffective and may lead to the suppression of important security issues.
• Some argue that the article may be generated by a large language model, but others disagree and point to the post's substance and detail as evidence of its authenticity.
• The use of a computer to help create the post content is seen as irrelevant and not a reason to doubt the article's validity.
• The incident highlights the need for better enforcement of data protection regulations, such as the EU's GDPR, to prevent companies from ignoring security issues.
• Some commenters believe that the article's narrative is plausible but possibly made up, while others see it as a genuine account of a common problem in the security industry.