1

I am in contact with a potential employer via email, my application is still "under process", but while browsing their website, i found a very critical security risk and also a terrible issue with the online website that is probably costing them customers.

Should i inform them about it?

Should i mail the hr persons directly, because only they know me yet and i only know that email address.

The problems that i think this will cause are:

  1. They may consider me too "cheesy"
  2. It may cause some problems to the original developer that is working on this production website (or worse they may start hating me lol )

Need suggestions.

5
  • 6
    An HR person won't know what to do with the information and at best will ignore it, at worst will either delete your application or accuse you of hacking their system.
    – alroc
    Nov 14, 2014 at 19:20
  • thanks, but i didnt actually try to hack their system, i just clicked a simple link and it came up on my face
    – shaheer
    Nov 14, 2014 at 19:23
  • I'd say hold off until either a week has passed or you have been brought in to interview. If you get the interview, then politely bring it up. If you don't, then see if you can identify who the main contact point is for the website and email them.
    – NotMe
    Nov 14, 2014 at 19:38
  • @shaheer it doesn't matter. What matters is how the HR person will perceive what you said (perception is reality). That person does not understand what you're saying and what you did, and can very easily interpret what you're saying as a threat. I've had people accuse me of "hacking" their computer simply because I brought a command prompt up, leaving the familiar confines of the point & click interface which is all they know a computer to be.
    – alroc
    Nov 14, 2014 at 21:19
  • @shaheer Read this story (thedailywtf.com/articles/pizza-hacker) and be enlightened. ;)
    – Masked Man
    Dec 23, 2016 at 9:41

3 Answers 3

2

You're better off not revealing this kind of information to HR. Wait until either during the technical interview or after the application process to reveal this information.

It is best to wait to discuss these issues with someone technical. A technical person is in a better position to exactly understand the ramifications of what what you are pointing out and do something about them.

In the interview:

Depending on how you broach the subject in the interview, you could come out looking very good to your potential employer by pointing out areas you see that need improvement. It shows that you have done your research into the company and taken the time to analyze their methodologies. It is important that you let the interview progress to this subject naturally so that you don't come off as accusing your potential employer of having poor security or design practices.

If you don't get a chance in the interview and don't get the job:

Send the company an e-mail through the "Contact us" part of their website. You could identify yourself if you wanted to do so. If you do, you could say something along the lines of "Hey, I'm shaheer, I just applied [and/or interviewed] here, while I was exploring the company website I noticed that there was a flaw at this location (hyperlink). This could potentially be dangerous because of XYZ reasons."

2
  • thanks a lot for the answer, i thought this will help me in my application :/
    – shaheer
    Nov 14, 2014 at 19:47
  • 1
    It is unlikely that HR will forward your note unless it sounds exceedingly dangerous and pressing. If you point out the dangers of a security flaw in detail to someone less technically oriented it could also come across as threatening.
    – Conor
    Nov 14, 2014 at 19:57
1

Is this a risk or is this an improvement?

If this is a risk, then how severe is it? Could a an attacker use this to bring the service down, or otherwise access confidential data? If so, I would try contacting the company directly. If you do so, don't even mention that you're currently interviewing for the company. I would approach this as if you had no affiliation with the company, so be just as respectful and professional as if you were speaking to them face-to-face.

If what you're proposing is an improvement, then save it for the interview or possibly afterwards. By improvement I mean an actual change to the behavior of the website, not just a simple fix. An example would be missing form validation or a script that crashes under certain circumstances. While it would probably be nice to have these things fixed, it's certainly not critical that they get fixed.

If the job you're applying for is related to the issue that you've found, then you might bring this up during the interview. It would show a level of understanding and research that could boost you past other potential candidates.

If the job you're applying for is unrelated to the job that you're applying for, save it for when you get hired. You don't want to bring up what you see as a "problem" during a time that they are trying to assess you. You also don't want to come across as threatening. However if you're working for the company, then you should be able to find out the right people to contact regarding your concern.

Also keep in mind that many companies operate on a limited budget. Some companies will outsource their web or IT work out to save on costs. Others will have a small team (sometimes it's just one person) that have to work on a huge number of projects. It's very well possible that someone is already aware of the problem or group of problems with the website, but other items take priority. Therefore if it's not going to be your priority if you land the job, then waiting until after you're hired will help all parties involved.

Whatever you do, don't bring the HR person into this. Nobody wants to be the guy saying "hey some person we've considered hiring has a problem with our work".

2
  • didn't think of it this way (problem with our work), this company has good budget and actually has an it team, the issue is seriously critical in two ways, it is costing them customers (no customer can actually order something from their website in current state), it is a security issue (someone can bring the site down)
    – shaheer
    Nov 14, 2014 at 20:22
  • 1
    @shaheer in that regard, I would send an email to their web admin if possible. Otherwise, use the contact form. If you still see the issue by the time you're ready for the interview, I would say something like "I noticed an issue with ordering on your website, is there someone I can direct my concern?"
    – user17163
    Nov 14, 2014 at 20:27
0

Save it for the follow up to the technical interview once you have the emails of the management that's interviewing you.

Start by thanking the interviewing management for giving you the interview. The thanks establish to those who did not interview you how the company got to know about you.

Be careful to explain how you discovered the security flaw. "I browsed the site" is a b.s. explanation - tons of people browsed through the site without discovering anything. You certainly don't want to raise the suspicion that you did something improper to discover the security flaw. Discovering the security flaw is nice but how you went about to discover the security flaw could kill your candidacy if they think you did something unethical to find it.

Make sure to include links to any published info on that security flaw in your communication that confirms your allegation and offers diagnostics methodology and corrective action.

Include a paragraph about your credentials with respect to security. It is important for the target of the communication to know that you yourself are an authoritative i.e. reliable and credible source.

And end your communication by stating that you can be reached for any further qestions and you prefer to be reached.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .