Hacker News Reader

Just formally ask the company, if they don't want you to they will tell you. Could be worth including a pitch of sorts ('Hey, Ive noticed a few problems using your site...') but MAKE SURE you don't incriminate yourself. Do NOT show evidence of you 'reverse engineering' anything.

Do not do anything without gaining permission, as there's a very good chance you're going to run into their legal team.

View on HN

I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).

Starbucks has a bug bounty program, and they do actually pay out. https://www.starbucks.com/whitehat

Nice (altough the URL does not work) unfortunately in our startup nation there are 0 programs like this :(

Reply on news.ycombinator.com