-2

I work as Developer in a big company, I found security vulnerabilities that let me login to any user accounts in the system. I told my team and my boss for about 9 mounts ago.

my project manager and my team leaders don't prioritize the ticket so it gets done by somebody.

What can i do? I have signed contract so i cant just go out and tell about it to somebody outside the company.

What if i stooped working there right now? can i tell or write about it on my website or blog?

Can i do something without getting fired or get in trouble ?

4
  • 1
    What jurisdiction does this relate to, as whistleblowing provisions could be relevant?
    – user35069
    Commented Dec 7, 2021 at 13:43
  • 3
    I’m voting to close this question because this is asked in a way that it belongs to Workplace, not Law.SE
    – Trish
    Commented Dec 7, 2021 at 15:38
  • 1
    What is your problem exactly?
    – Greendrake
    Commented Dec 8, 2021 at 8:48
  • 1
    This is asking, albeit in an awkward way, what legal protections a person has in a particular situation. It is perfectly on topic here,. even if it might also be on-topic on workplace, It should not be closed. Commented Dec 11, 2021 at 1:32

2 Answers 2

3

Every software is potentially vulnerable, unless it runs on an air-gapped computer with sealed data ports. How vulnerability fixes are prioritized against other goals is usually a business decision, legitimately made by the management. There are some jurisdictions and issues where the law requires them to act, but again there is usually a judgement call involved. For example, the GDPR talks about due regard to the state of the art.

What you describe seems to be a difference in opinion about the importance of the fix. Ask about that at Workplace SE, not here. There are ways for software developers to influence their management, but ultimately the management is responsible for the outcomes and gets to decide.

  • You can inform your superiors, in writing. If you are in a large company, there may be a legal or compliance department. Inform them if you have a reason to distrust your superiors.
  • In most jurisdictions, you cannot simply talk to the press, either now or later.
  • If you believe that your company is acting criminally, talk to a lawyer.
0

You can report the vulnerability to your company, and make sure there is evidence that you have reported it.

If people suffer damages because of this vulnerability then the company may be liable. If people suffer damages and the company knew about this vulnerability for a long time, without trying to fix it, the chances that they are liable are much higher.

That’s what you can do legally. Make it a high risk for the company to ignore your report. If you can login to any account because you are in a privileged position, that is one thing. If an outsider could do it, then a reasonable company would fix it. Your company isn’t required by law to always act reasonably.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .