I'm not sure an unprepared one can leak anonymously and safely.

Eh, quick DM to Wall Street Journal or Financial Times and if it's a decently large bank the PR fallout will quickly prevent any potential retaliation.

Probably not. Bugs like these happen all the time at big financial firms.

just post your findings from an internet cafe on 4chan and watch the competitor burn

Serious question: are internet cafes still a thing?

Admittedly this is from a small sample of Seattle-area coffee shops but most of my experiences with non-home non-work WiFi is at coffee shops that provide the WiFi but expect you to bring your own device (laptop, phone, etc).

Is it still common to go someplace and rent time on a computer provided by the owner (i.e., at an internet cafe?)

I don't think places you can rent machines are common (except libraries as noted but these may require ID) but the steps "buy machine with cash, take machine to anonymous cafe outside your area and get wifi password, upload info" still seem reasonably secure. You can throw the machine off a bridge later if you're paranoid - and work hard at sanitizing your info while you're at it.

Can you just spoof your MAC address instead of buying a new machine?

possibly but will you bet jail time on it?

>Serious question: are internet cafes still a thing?

I live in a capital city and am aware of at least three of these still kicking around.

You can do it for free at a library.

>are internet cafes still a thing?

I don't know about internet cafes specifically, but pretty much all cafes have internet these days.

Here in Germany there are still a lot of them around. Though any rando WiFi hotspot would propably do the trick

Public libraries are much better for this and easier to find.

Issue is, he will be stored in logs traversing through accounts not his.

If you're going spelunking you'll take precautions to mitigate the risk of it being traced back to you.

I think a lot of hackers start with just seeing what’s going on without any intent to dig deeper. But then something too good to pass up gets them high, and with weakened inhibitions, they make bad decisions that require responsible disclosure (in lieu of saying and doing nothing and possibly getting into more trouble). Of course a responsible disclosure is always prudent, and these companies certainly did not deserve one, but the hacker here got too excited. They didn’t cover their tracks first, necessitating a responsible disclosure.

Yeah but that wasn't the situation. Twas a bit late for that by the point OP discovered there existed a security issue in the first place and they had even already "exploited" it.

It's not a leak to publish your own original research.

... or report the vulnerability anonymously?