content: I do information security for a living. Every company will be different. Some companies welcome responsible disclosure, and even have a bounty program to reward people for finding serious issues. Others are like Starbucks - they get a report, ignore it for as long as possible, then get belligerent with the person reporting the bug if they go public with it. It all depends on the company. My company falls into the latter - when we get a report from outside, we verify it then forward it on to DEV/QA for fixing, but don't reply to the external person. Management's line of thinking (which I mostly disagree with, but that's another story) is they don't want to encourage people to poke around our sites and break shit. Its partially valid as there are A LOT of 'hackers' out there that, while they have good intentions, really have no idea what they're doing, and those are the ones that are liable to go too far in 'testing' your systems and can cause real damage and outages unintentionally. I believe this researcher screwed up in actually exploiting the bug. He probably should have alerted Starbucks without actually exploiting it, even if it was a miniscule amount. However, most companies probably wouldn't take a report like that seriously. Bottom line is, if you're going to be doing this type of activity, be SURE you understand the companies approach to bug hunting BEFORE you go and exploit/test their systems. If a company doesn't have a clear and understandable public policy on this then stay away, the company is most likely hostile to this type of activity.