That's a good question. But it is a very fine line between being a white hat that reports a vulnerability in good faith and someone who actually exploits that vulnerability and turns a vulnerability report into an actual breach. This is - in my opinion, clearly the HN hive mind disagrees - across that line.

For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.

Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.

[delayed]

I don't argue it is not good faith. I just wonder if OP realized that they might be crossing a line they shouldn't be crossing, ever, while doing security research without being under contract to the party they are investigating.

Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.

The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."

To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.

Im not sure why you're arguing for an nda. Ive done a lot of security work under contract, the nda consistently means the company will file the report away and never talk about it again.

If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.

Under an NDA you might be allowed to download bulk data and use it to see if you can get further into the system.

Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.

I would rather the company’s practices be exposed than my info appear as yet another HIBP entry.

Even if the company ends up paying damages, it’s too late for the true victims.

That's true. The GDPR was made well before AI and I suspect that there will be an update that will take the new reality into account.

[delayed]