Disclosure

[Saphex <saphex () gmail com>]

Hi,

I have been wondering, how to disclosure vulnerabilities. If some
corporate web site has a vulnerability, witch is the best approach to
reveal that vulnerability to them? Without getting a lawsuit or
something?
Is there some law compliant way of doing it? Lets assume they didn't ask
for the security *testing*.

Best regards,
saphex