Recommended process to report website security flaw

[Bernie]

I am able to download any benefit statement from a companies website by changing the URL, even though I have logged in as myself. If I tell them will they sue me as I probably did technically break the law from reading previous threads on here. I only tested two to make sure.

Their contact page only lists an "info" address, I don't want to send the details there as it will probably go to 10 different people. If I call them they will get me arrested


How would you go about this?

 

[Necropolis]

Try and get hold of someone in their IT department....

 

[Sinbad]

I'm sure they won't arrest you.
Contact the info address and ask them to get their security team to contact you.

 

[Necropolis]

Ask MagicDude4Eva for tips on what not to do

 

[Bernie]

I'm sure they won't arrest you.
Contact the info address and ask them to get their security team to contact you.

This is exactly what I have done. Just waiting and see what happens.

 

[Bernie]

Ask MagicDude4Eva for tips on what not to do

Exactly