I did contact them via every medium I could find, not just email. Obviously, the response these folks got from the company should have told them they were talking to the wrong person, and they should have been more vigilant in attempting to contact the right person.
Their response was that it is not bad system or insecure because the information is only available for logged users. So the api just needs authentication header.
So all the user data could have been easily collected to own database using simple script.
What does this mean? They tracked you down?
From my perspective, protecting the data of 10k users was just as important as— or more important than— protecting the data of 1.5m users.
I feel bad when people assume negative intent. I don’t think anyone at this company wanted to violate the privacy of their users— they just didn’t get the message through the right channels.
care to elaborate on a logic behind that?
1) early users feel the most connected with your technology and are the most hurt when you screw them over. At that stage, it can sink your company. 2) fixing this when you have 10k users prevents you from leaking the data of the next 1.49m users.
Smaller companies that don’t have a bug bounty might provide a token reward just because, larger companies generally won’t.
Any company that hasn’t explicitly authorized ‘research’ might also choose to sue.
It’s not because everybody stink that you know they/their stink or can exploit it.