Found a Bug? Report It Right

You notice something odd

You just bought a poster on a pretend shop. The web address for your order ends in a number. Change that one number and the page shows a different order. Try the arrows.

shopstars.example/order/1047

Change the number:

That is a real kind of bug. The shop forgot to check that the order belongs to you, so hands out anyone's order to anyone who asks. You did not hack anything. You changed a number in plain sight.

So what do you do?

Nobody is watching. The orders are right there. Pick the move you would make. There is one right answer, and it is the one that helps people.

You chose to report it

That is exactly what a real security researcher does. It has a name: responsible disclosure. You tell the owner privately, you never use the flaw, and you wait while they fix it. Here is the message you would send.

To:security@shopstars.example
Subject:Possible bug: order pages may show other people's orders
Note:Changing the order number in the address loads a different order. I did not open anyone's order or save any details. Please take a look.

The three rules of a good finder. Tell the owner privately so they can fix it before anyone is harmed. Never use the flaw or open someone else's private data. Wait and let them patch it before you tell the world.

Some shops even pay you for it

A bug bounty is a reward a company offers to people who find a problem and report it the safe way. It turns careful, honest people into the company's extra set of eyes. Big names run these:

A search giant report a real flaw, get paid $$$

A phone maker serious bugs, serious rewards $$$$

Your favorite game a thank-you, a shirt, or cash $$

This is the white-hat path. A white hat finds holes to help close them. The line is simple: if you would not be proud to say it out loud to the owner, do not do it. Looking is fine. Helping is better. Peeking at private data is over the line, every time.

You notice something odd

So what do you do?

Look through other people's orders

Close the tab and forget it

Tell the shop's security team, privately

You chose to report it

Some shops even pay you for it