You have found something that looks wrong: a page showing another person's data, or an endpoint that answers when it should refuse. What you do in the next hour decides whether this becomes a fixed vulnerability and a thank-you, or a problem for you.

This is the process I follow. It has taken a finding from report to national CERT validation in 48 hours, and from report to paid bounty in twelve days.

This article describes my own practice. It is not legal advice. If you are unsure whether something you are doing is lawful, stop and get advice first.

Step 1: Stop, and collect only what proves the flaw

The moment you realise you can see data you should not, stop exploring.

  • Capture the minimum evidence that proves the flaw exists: one request and response, ideally involving your own account or data.
  • Do not download, copy, keep or share other people's records.
  • Do not try to see how far it goes by pulling thousands of records. The scope can be explained in words.
  • Do not change or delete anything.

With the BillPoint flaw, I confirmed the behaviour against my own account only, then stopped and reported it.

Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act makes unauthorised access to computer systems an offence. Good intentions help you, but staying within minimum necessary access is what keeps your actions defensible.

Step 2: Write down what you did, while it is fresh

Record:

  • the date and time
  • the affected system (domain or app name, not a public post)
  • what you did, step by step
  • what you saw, described rather than copied
  • why it matters: what an attacker could do with it

This becomes your report, and your record of acting in good faith.

Step 3: Find the right owner

In order of preference:

  1. A published security contact. Check for /.well-known/security.txt on the domain, a "security" or "responsible disclosure" page, or a bug bounty programme.
  2. A named technical leader. For Miva Open University, I contacted the university's CTO directly and asked for a secure channel before sending any details.
  3. ngCERT, for government systems or when the owner cannot be reached. Nigeria's national Computer Emergency Response Team coordinates incidents affecting government and critical systems. My Corporate Affairs Commission report went through ngCERT, which opened a ticket the same day and validated the flaw two days later.

Avoid general customer support inboxes and social media DMs for the details. Ask for a proper channel first.

Step 4: Send a report an engineer can act on

A good report is short and specific:

  • Summary: one sentence on the flaw and its impact.
  • Affected asset: which system.
  • Impact: what data or action is exposed, and to whom.
  • Evidence: the minimum needed to reproduce, shared privately.
  • Suggested fix: for access control flaws, usually a server-side ownership check on the affected route.
  • Your conduct: state that you accessed only what was needed, kept no data, and will not publish while the issue is open.

Offer the full technical detail on request rather than attaching everything to a first email to an address you have not verified.

Step 5: Give them time, and follow up politely

Organisations need time to route, confirm and fix. A common convention is 90 days before any public discussion, but agree a timeline with the owner rather than imposing one.

If you get no reply after a week or two, follow up once. If there is still silence and real people are at risk, escalate to ngCERT.

Step 6: Publish only what is safe, and only after the fix

If you write about it later:

  • describe the class and impact of the flaw
  • never publish endpoints, payloads, identifiers or screenshots of real records
  • wait until it is remediated, or until the owner agrees

The goal of publishing is to show judgement and help others fix the same bug, not to hand anyone a map.

A short template

Subject: Security vulnerability report: [system name]

Hello,

I found a security issue in [system] that exposes [type of data]
to [who]. I have accessed only the minimum needed to confirm it,
have kept no data, and will not share details publicly.

Could you point me to the right person or a secure channel?
I can send full technical details there.

Regards,
[name, contact]

Found a flaw in something I built? Email security@ndemafiawilsmith.com. My own disclosures are summarised on the research page.