Ask HN: How should I disclose this use-after-free bug to a small vendor?
I work at a small company and we deal with other small(ish) companies to fill our workstations with lots of enterprise ERP stuff. Today I discovered a pretty diesel credential bypass bug in an expensive tool we pay maintenance on. The thing is, this bug could also be exploited as a use-after-free bug, depending on who's using it. So by having this bug we could potentially use the software beyond our contracted date, but it also means an unauthorized person could use it to gain access.
My company is small enough and the workers non-technical enough that I don't really have to worry about this bug being exploited on the inside, and I've seen no mention of it being exploited elsewhere and it works on several patch levels. I've contemplated keeping the bug a secret in my KB to ease my headache when we inevitably let our maintenance expire, but I've also contemplated reporting it to the vendor to have the security aspect patched. The thing is, part of me feels our business should be rewarded for disclosing a bug that we could have just exploited to save thousands of dollars.
Tl;dr I found a use-after-free bug in expensive and closed-source enterprise software by a small vendor and I'm torn on [whether to&how to] report it while asking for a bounty in the form of free maintenance, or just keep it to myself.