united-states copyright software
Reporting an app vulnerability to the authors
<p>At the beginning I'd like to inform that the case refers to US law, which I am completely unfamiliar with.</p>

<p>Cutting to the chase, I've been recently training reverse engineering skills on lately published, closed-source application. I found that there is a serious vulnerability which allows to easily bypass serial code verification.</p>

<p>And now I want to report this to authors, so that they can fix it. Of course the research I've made on this application was solely in order to broaden my knowledge on reverse engineering and I was not going(and I am still not) to publish any kind of crack. I am acting in good faith intention.</p>

<p>So I want to know whether the authors could accuse me of breaking copyrights, etc. if they turned out to be unfriendly?</p>

<p>Regards</p>

<p>Since it's a closed-source app, what you've probably done is broken their terms of Service (TOS) agreement for use of the app. Read it; it probably says that reverse engineering is illegal and a violation of applicable laws. Depending on the country you are in, those laws may or may not apply to you.</p>

<p>That said, since you want to be honest and disclose the vulnerability, you can do this (bearing in mind IANAL and it's your choice):</p>

<p>Send an anonymous email from a new "burner" email account (and an account you don't use for anything else after that) and also preferably by using the Tor browser ( <a href="https://www.torproject.org/download/download-easy.html.en" rel="nofollow noreferrer">https://www.torproject.org/download/download-easy.html.en</a> ) so your IP is hidden and inform them of the security issue and what you see as your ethical response to disclose the vulnerability and that you do not intend to publish source code or the vulnerability. And see what they say.</p>

<p>If they are unhappy with your reverse engineering, they will say so and may not even acknowledge the security issue; but your identity will be hidden, and you will have done your ethical duty.</p>

<p>If they are happy with your disclosure and your skills, they might pay you, as it is fairly common for software companies to pay bounties for security bugs. Or they may hire you.</p>
