Responsible disclosure

In short: Whoever finds a security hole reports it to the operator first and gives them time to fix it before details become public.

In more detail: Many operators offer a reporting address (security@…, /.well-known/security.txt) and sometimes rewards (bug bounty). A typical time frame is 90 days. Anyone who tests foreign systems without permission may commit a criminal offence under computer criminal law (computer criminal law).

In Depth

• security.txt: a small text file with contact, encryption key and policy.
• Good report: what, where, how reproducible, what impact. Do not copy third-party data.
• Permission: Only test systems for which authorisation exists.
• Counterparts: full disclosure (publish everything at once) and keeping silent.

See also: OWASP Top 10, Computer criminal law