contract-law security
i find a security vulnerabilities but my company dont put time to fix it
<p>I work as Developer in a big company,
I found security vulnerabilities that let me login to any user accounts in the system.
I told my team and my boss for about 9 mounts ago.</p>
<p>my project manager and my team leaders don't prioritize the ticket so it gets done by somebody.</p>
<p>What can i do? I have signed contract so i cant just go out and tell about it to somebody outside the company.</p>
<p>What if i stooped working there right now? can i tell or write about it on my website or blog?</p>
<p>Can i do something without getting fired or get in trouble ?</p>

<p><strong>Every</strong> software is potentially vulnerable, unless it runs on an <a href="https://en.wikipedia.org/wiki/Air_gap_(networking)" rel="nofollow noreferrer">air-gapped</a> computer with sealed data ports. How vulnerability fixes are prioritized against other goals is usually a business decision, legitimately made by the management. There are some jurisdictions and issues where the law requires them to act, but again there is usually a judgement call involved. For example, the GDPR talks about <a href="https://gdpr.eu/recital-78-appropriate-technical-and-organisational-measures/" rel="nofollow noreferrer">due regard to the state of the art</a>.</p>
<p>What you describe seems to be a difference in opinion about the importance of the fix. Ask about that at <a href="https://workplace.stackexchange.com/">Workplace SE</a>, not here. There are ways for software developers to influence their management, but ultimately the management is responsible for the outcomes and gets to decide.</p>
<ul>
<li>You can inform your superiors, in writing. If you are in a large company, there may be a legal or compliance department. Inform them if you have a reason to distrust your superiors.</li>
<li>In most jurisdictions, you <em>cannot</em> simply talk to the press, either now or later.</li>
<li>If you believe that your company is acting criminally, talk to a lawyer.</li>
</ul>

<p>You can report the vulnerability to your company, and make sure there is evidence that you have reported it.</p>
<p>If people suffer damages because of this vulnerability then the company may be liable. If people suffer damages and the company <em>knew</em> about this vulnerability for a long time, without trying to fix it, the chances that they are liable are much higher.</p>
<p>That’s what you can do legally. Make it a high risk for the company to ignore your report. If you can login to any account because you are in a privileged position, that is one thing. If an outsider could do it, then a reasonable company would fix it. Your company isn’t required by law to always act reasonably.</p>
