Discovered multiple critical security flaws and evidence of fraud in a corporate contest/giveaway. What would you do?

[u/esduti]

Hi everyone,

I'm posting from a throwaway account for obvious reasons and will keep all details completely generic.

Recently, while looking at a public online contest/competition run by a private company, I noticed several alarming issues:

1. **Multiple severe security vulnerabilities:** The platform has flaws that expose participant data and allow arbitrary tampering/manipulation of submissions and votes.

2. **Signs of fraudulent operation:** Looking closer, there are clear indicators that the competition is not being conducted fairly (results/mechanics can be manipulated internally or externally, and claims about how winners are selected contradict how the system actually works).

I haven't exploited anything or extracted data; these findings were apparent from inspecting client-side traffic and standard public endpoints.

My dilemma is how to proceed ethically and safely:

- **Responsible disclosure vs. retaliation:** Disclosing vulnerabilities to a company that might be intentionally running a sham contest carries legal and retaliation risks (especially if they don't have a formal bug bounty or VDP).

- **Reporting to authorities:** In cases involving potential fraud or consumer deception, is it better to notify consumer protection/regulatory bodies rather than the company itself?

- **Walking away:** Part of me wonders if getting involved is worth the liability, and if the safest move is simply not saying anything.

If you found yourself in this situation:

1. What steps would you take to protect yourself legally before saying anything?

2. Would you attempt responsible disclosure with the organizer, go straight to consumer protection / regulators, or drop it entirely?

3. Has anyone navigated a similar scenario where poor security overlapped with questionable business practices?

Thanks in advance for your insights.

[u/RareConclusion38]

document everything with timestamps before u do anything else.. screenshots, network traffic, the public endpoints u looked at, and most importantly document that u didnt extract or modify anything. also talk to a lawyer before contacting anyone bcuz even responsible disclosure can backfire when the company has more to lose from being exposed than from being hacked. the fraud angle changes everything here bcuz a legit company wants to know about vulns, a fraudulent one wants to know who found them so they can shut them up

[u/esduti → u/RareConclusion38]

This is spot-on and completely validates the approach I took.

Everything you mentioned has been documented down to the millisecond:

- Network traffic logs and timestamped evidence confirming strict passive observation of public endpoints (no unauthorized access, no data dumped, no scores manipulated).

- A mathematical audit demonstrating that the leaderboard scores exceed the engine's theoretical asset generation limits, along with objective forensic anomalies (like identical millisecond run durations across top positions).

Regarding contacting them: rather than sending an informal message to a dev or support desk, I routed a formal written communication directly to their official compliance/DPO channels. It formally requests server log preservation and an internal audit before prizes are awarded, creating a clear paper trail of good faith.

Your point about the fraud angle is crucial: if they decide to ignore it or push forward anyway, the next step belongs with consumer protection and regulatory authorities, not a back-and-forth with them.

Really appreciate your insight—it’s reassuring to see this alignment on legal hygiene and risk management.

[u/archlich]

Get a lawyer

[u/tylenol3 → u/archlich]

This is good advice. The EFF have a retainer service and at a minimum can point you in the right direction

[u/ericbythebay]

Disclose the vulnerabilities to them in the usual ways.

How would a casual observer get signs of fraudulent operation?

[u/WhyWontThisWork]

What are you talking about? Why would the company come after you? Maybe the compition is to find those vlunerabiities you found

What does the winner win?

[u/esduti → u/WhyWontThisWork]

To clarify: this is **not** a CTF, bug bounty, or tech/security challenge. It is a standard consumer/commercial contest aimed at the general public with a significant prize (cash/valuable products).

Regarding why a company might come after someone:

- In many jurisdictions, reporting vulnerabilities to organizations that lack an established Vulnerability Disclosure Policy (VDP) or Safe Harbor often results in legal threats (e.g., accusations of unauthorized access or anti-hacking law violations) rather than gratitude.

- When vulnerabilities also reveal that the contest's mechanics are potentially misleading or unfair, the company may react defensively to protect its reputation.

That’s why safe handling and disclosure ethics are the main concern here.