Last night I was familiarizing myself with the codebase of an application that I will begin supporting. In doing so, I found a vulnerability that needs to be resolved. This application is core to the business, and if it is exploited, sensitive information will become available. In addition, this application has only gone live in the last few months, so I was really surprised at the use of code that has been considered obsolete and vulnerable for years.
After this discovery, I sent an email to the developer of the application explaining that this is an issue and why. I attached several links and a few academic papers to support what I was saying. His response was basically 'Yes, this could be better'.
I am good friends with this developer, and don't want him to feel that I am trying to dictate how his application should or should not be written, but this is a big issue. In the email, I started by saying that I wanted to bring this up with him before I talked to the Director of Security about this.
How long should I give him to get this fix on the docket before escalating to the Director of Security?