Hi all,

Recently I have been searching the web as you do and notice a lot of issue on sites I have visited like:

Password being stored in plain text
user enumeration
credit cards not stored correctly

so on

I just want to find out if this was you would you disclose them or just ignore because it not worth the hassle ? also how would you disclose them I have sent email asking if they have security team but no reply so far.

I would also be hesitant to start the conversation with, "Do you guys have a security team?"

That would, first of all, put me on the defensive from the get-go. Secondly, I'd probably expect to hear you say something along the lines of, "Well, if you don't, I can help you out." After disclosing a security vulnerability unsolicited, this can be construed as unethical behavior.

I was hoping your reasons were as such.

Either way, it's up to you if you want to discuss with them, or not.  Again, just note, that if you weren't asked or contracted to analyze them, you'd better be ready to play really dumb when they ask you why you were posting dummy credit card numbers, etc.  They could 'possibly' interpret that as credit card fraud, as well.  (Depending on where you stored it, and why...)

Just be cautious...

I suggest you contact them in an officially looking e-mail where you point out that you haven't attacked them but rather observed how their website function and that the current structure is insecure. Make sure you point out you're doing it for free and that you're not selling any services. (Otherwise they might see it as blackmail, I've experienced that on a few occasions where I even stated it was free.)

Also, you can write to the webmaster or perhaps if they have a security department those as well, but usually you get the fastest response and activity via HR. When I've contacted administrators directly I've mostly been met with hatred or ignorance. In some cases my direct contact with e.g., the webmaster has been much appreciated though.

Some companies may take this as a personal insult or attack as well, so be prepared for whatever response they come up. Some will also say they're going to fix it, and then it won't get fixed, even a year after, and we're talking about quite serious vulnerabilities here too.