Hacker News Reader

I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact.

How should I report it in your opinion?

View on HN

Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty

It's not. They may have a private program, don't know.

Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc.

In the EU, you might be able to report it to a regulator. In Russia, perhaps not.

Reply on news.ycombinator.com