Archive of Legal Threats Against Security Researchers for Vulnerability Disclosure

Security Researcher Discovers Critical Data Vulnerability in Sports Insurer Portal, Faces Legal Threats Instead of Cooperation

What happens when you responsibly disclose a critical vulnerability exposing personal data - including that of minors - and the organization

Microsoft bans security researcher from GitHub after zero-day exploit posts; researcher threatens retaliation

"I will make sure your bones are shattered [on July 14]"

Microsoft bans security researcher from GitHub after zero-day exploit posts; researcher threatens retaliation

"I will make sure your bones are shattered [on July 14]"

Security Researcher Discovers Vulnerability in Legal AI Platform Exposing 100k+ Confidential Files

Update: This post received a large amount of attention on Hacker News — see the discussion thread.

Snyk vulnerability disclosure program: what’s going on behind the scenes?

County Government Reportedly Paid $1 Million to Cyber Extortion Group

The alleged victim, believed to be a small Ohio county, reportedly paid the extortion group to prevent the public release of sensitive stole

Researcher Discovers Critical React2Shell RCE Vulnerability (CVE-2025-55182) Affecting Millions of Websites

The story of CVE-2025-55182 (React2Shell)