Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further

it's not proof of guilt but a reasonable trail to follow up on

I think it is a stretch. What basis would someone use, who knew enough to disclose immediately, to bet their freedom that it was being exploited by others such that they could exploit it without their initial disclosure providing probable cause that he was the exploiter? I can't even think of a movie where that happens, probably because it's impossible to create a suspension of disbelief with the plotline.

> think of a movie where that happens, probably because it's impossible

Always reminds me of a CSI (original series) interview with the actor who played Grissom; the writers contacted the police and forensics labs for story ideas but the real life events were so insane that they would feel too fabricated for television.

People are generally greedy and often dumb; maybe they found an open house door, put a little note in the mailbox, slept on it and thought maybe they could get away with a further peek inside if no one closed the door yet (which makes the perpetrator think they didn’t read the note yet)?

On one hand, someone working infosec might also have access to a spare computer running tails, which they use to sell the exploit to a third party exploit customer, but only after reporting the exploit to the victim company to cover their tracks regarding liability for things like those IP logs. On the other hand, it's not uncommon for a vulnerability to be detected multiple times by different unrelated people, especially if that vulnerability makes itself know via semi-regular use of the product/service.

Aren't you just proving their point?

Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.

OP's employer would likely want to avoid looking complicit in hacking a direct competitor to their line of business. What they did does not look overly unreasonable from that POV, the problem is OP put them in a pretty bad position. It's not just about being factually right either, appearances can matter too.

OP, absolutely, did not, put their employer into any kind of situation. Thanks for F-ing helping.

If the retention of the employee is seen as a liability, then that's it, he's out.

Very unfair from employees perspective, but 'self interest rational' from the Corp.

If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go.

Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't.

It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.

I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.

It's not unreasonable. It may be stupid, but criminals do stupid things all the time. Someone has to be first. Turning the investigation over to the authorities to investigate is also reasonable.

What's disappointing is that his company didn't stand by him during the investigation, especially since he reported it.

To me that is actually grounds for OP to sue the employer for slander/libel/unjustified termination etc. OP did their part and the employer didn't.

Do you have a legal background? I don't; what I know about defamation law I mostly get from religiously following Ken White. This doesn't sound like an especially plausible case of defamation. If it helps: absent a contract saying otherwise (pretty rare) employers in the US can generally fire you because they don't like your new haircut.

(With the exception of firing you for protected reasons/classes, like race, gender, sexuality, etc.)

This just in: https://www.jdsupra.com/legalnews/hair-discrimination-the-ne...

It is not a smoking gun. Now if they find unique product obtained through a transaction it would be.