Hacker News Reader

Had a similar issue with Southwest Airlines a while back. I wound up emailing a VP directly with screenshots and repro steps by looking up other SW email addresses to figure out their work email format, and then getting the VP's name from LinkedIn.

The VP responded pretty quickly, forwarded my email on his people, and I wound up getting some free miles.

I was kinda surprised to learn how easy it is to get most corporate email addresses through this experience.

The public disclosure part is really important as it's basically the main stick forcing companies to actually fix things in a timely manner in any case where there's not a direct threat of financial loss to the company.

I once reported a similar XSS session hijacking bug in the LMS our district used in highschool. The response? Something along the lines of "hmm, maybe you just shouldn't do that"