Kind of a jerk move.
Bug bounty programs searching for security vulnerabilities rarely need completed proof of concept exploits – crashes are enough. You've laid down all of the pieces for someone competent to potentially do some real damage without much work at all, and that's exactly why the request was made not to disclose any further vulnerabilities.
And yes. You completely went around their request, and made this info public without their consent.
Actions like this are THE reason the relationship between vendors and security researchers is strained.
There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosure.
IANAL, but you also violated their ToS by doing this, and if you did this to a site I owned, especially without my consent, I'd be very motivated to contact the proper authorities and pursue civil remedies.
Actions like this are THE reason the relationship between vendors and security researchers is strained.
Secondly, why are "non-americans" cool with breaking other peoples shit without permission?
You want the owner to be cool with you disrupting business, causing untold financial damage?
PEOPLE like you are the reason that relationship is strained, and the reason the CFAA was written in the first place.
So please do keep "pen-testing" sites you down own without anyones permission, I'm sure you'll end up with a great life that way.
https://projecteuler.net/level=19
Look for the gold stars
Ex) https://projecteuler.net/profile/daguava.png
But you can also use this to quickly test the status of accounts.
For example, I was able to find Euler is an admin account by trying
https://projecteuler.net/profile/euler.png
It tells you it's admin in the image, why?
Edit: Wonder if they're exposing some vulnerability with the HTTP 300 Multiple Files they're returning.
If you try something like this: https://projecteuler.net/profile/.wat
the page confirms a .htaccess file exists at https://projecteuler.net/profile/.htaccess we also find one at https://projecteuler.net/.htaccess
While currently inaccessible, this is significant information leak
All directories allow this, so you can do some digging to find what files exist.
Edit 2:while logged in, you can enumerate all usernames with a skill level attached by using URLs like
https://projecteuler.net/level=1
If you try changing the level to a period, the page conveniently tells you there are over 118k users in total (listing the first 10k), and MAY even show accounts without levels, but I'm not sure.
Combine this with the profile image URLs above and you may be able to find more admin account usernames if they have levels associated with them.