Sign up ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

I am a web developer.

If I find a vulnerability in a prospective employer's website and notify them of it at the same as I send my (unsolicited) application, am I more likely to get the job? Less likely? Why?

share|improve this question

closed as primarily opinion-based by durron597, Ixrec, GlenH7, MichaelT, Dan Pichelman May 27 at 3:15

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

I would do it just to test your question empirically. Also, if they do not appreciate this find, then do you want to work for them? Interviews ought to go two-way, remember? Just be nice and professional and write it well. – Job Mar 7 '11 at 15:36

6 Answers 6

up vote 15 down vote accepted

Employers are notoriously fickle about their reasons for hiring people. They could be very impressed and grateful, or suspicious that you were probing their website. It's a crapshoot.

Personally, I would tell them anyway. Good employers will recognize the initiative, honesty and resourcefulness for what it is.

share|improve this answer
+1. Good employers will also recognize that finding the issue is more important than their ego, and thank you. – Matthew Read Mar 7 '11 at 16:09

Depending on what you sent them and how you communicated it I could see either being possible. To give a bit more of an elaboration on a couple of scenarios:

  • If the notification is of the form, "You suck because I could do this!" where you aren't helpful in pointing out how you found the issue or offer any ideas on how to fix it but just leave a general vague negative statement at the company then I could see them being pretty ticked and you would be less likely to be employed.

  • If the notification is more diplomatic and you end up helping them solve the problem in a way that demonstrates skill, a good work ethic and excellent communication skills then you may have a better chance because of that experience.

Thus I'd say it depends on how you handle it and how they see it. If they think you may have introduced the vulnerability then you could be in deep doo-doo.

Abusing the FTP and So You Hacked Our Site!? would be examples of articles where a business person didn't quite understand what kind of problems can exist if someone can do what they aren't supposed to do. Course some may just see this as paranoia. :)

share|improve this answer
Dude, "If they think you may have introduced the vulnerability then you could be in deep doo-doo." - what??? It is their web page. – Job Mar 7 '11 at 15:45
@Job, they may think that someone intentionally maliciously damaged the site to be the hero. Check out the plot to "Mission: Impossible II" if you want a Hollywood example of this. – JB King Mar 7 '11 at 16:06

Personally I wouldn't bring it up in the application, but I would work it into the interview.

Many questions could lead into something like "For example, I noticed your site allows for [insert security flaw here]", and you could follow up with how you would fix it or past experiences you have had fixing this sort of issue.

share|improve this answer

Don't bother doing it in the initial contact. The information will get ignored by the company's HR person/internal recruiter anyway because it is not relevant to their objective of sourcing candidates. At that stage you'd just be communicating to the wrong person.

Wait until you are talking to the hiring manager if you are going to do it at all.

share|improve this answer

If the employer is a good guy, he will talk to you, knowing that you know a lot of his application.

You did research, you used, you exploited his app. You showed a lot of interest in it and this kind of profile is good for employers.

On the other hand, they may claim you're an invasor, a "hacker", a guy who destroy things to get jobs. But you wouldn't like to work with this kind of guy, right? :-)

Go ahead and tell the guy you find a vulnerability on his app. You have nothing to lose ;-)

share|improve this answer

It might be worth a shot, although I agree with the thought that in a big company, the HR person isn't going to know what to make of it. Instead, mailing the bug, and your resume to the support staff for the site (if contact info is available) might get you noticed.

The next question is good or bad. Here's a few options:

  • Submit the problem, a suggested solution, and your resume. Be absolutely sure that your writing is top notch and very clear.
  • Be careful that no where in the submission you imply a threat. This is a fine line. Obviously you want to explain why the bug matters and what harm it could cause. But if it sounds like a threat, you are opening yourself up to defensiveness and hositility. For example "nice computer, it'd a shame if something should... happen to it." sounds like a threat when I read it in my mafia voice. Be careful since tone of voice can often be implied.
  • Absolutely give the solution, too. Otherwise, you have opened yourself up to the range of extortion and threats - they shouldn't have to hire you to get the answer.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.