Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly.

Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...

> Using anonymisation proxies just makes it all the more suspicious

If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer or anything of the sort, it's just the macOS equivalent of Fiddler: a localhost HTTP/HTTPS proxy that lets you decrypt TLS traffic (provided the client software isn't using certificate-pinning, which it wasn't).

From TFA:

> Wondering how I could feed them to the app, I set up Charles Proxy and pointed my phone to it. I honestly thought this wouldn’t work – who at this time doesn’t have SSL Pinning?

https://www.charlesproxy.com/

https://www.telerik.com/fiddler

As a curious user of other applications I've done the same thing the the author has described, so this kinda stuff isn't uncommon - except in my case I've never had an opportunity to stumble across anything as bad the author.

As for phone-app' insecure back-end web-services: that's about par for the course thesedays, even for banking and other "secure" services. It's depressing. I have plenty of my own pet-theories as to why things seem worse today than they were 10 years ago, but that's another discussion.

> If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer

I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.

Doing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.

I guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.

> and my employer would not fire me over such hearsay accusations from a competitor

So you think but you might be very wrong.

I might be, I suppose. Without going into details since this account is trivially traceable to my name, this wouldn't be the first thing the Internet tells me to never pull on my employer that went swimmingly. I do have some faith in my boss; it's a small company and security is a small world, and rich enough to not need backstabbing and politics a lot, thankfully. And I've got access to sensitive customer information on a daily basis (unpatched vulnerabilities), some trust is required in this field. If that wasn't there, I'd never have been put on projects or at least not lasted for very long.

Also note that I'm not in the USA and it's not this 2 weeks' notice wild west style employment (from my point of view).

> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work.

Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.

I've familiarized myself with the relevant computervredebreuk legalese and read that our public prosecutor doesn't prosecute cases where all the responsible disclosure guidelines were followed. (Of course they'll still check that they were, since not every claimed white hat is truly a white hat.)

These cases of just crossing the threshold are not that interesting to prosecutors unless affecting some company with a lot of political capital. If there is no restitution, no safety implications, no children harmed, and the case is a bit confusing, why take it? Prosecutors prefer to take the slam dunk cases where any normal person can agree it was an intrusive or fraudulent access.

Other jurisdictions are not so sensible.

You have a lot of trust in your employer.

One of the reasons that I like working there.