IT professionals use the Responsible Disclosure process to report vulnerabilities in software or systems fairly and with a focus on solutions. If you encounter this kind of security risk, first document it thoroughly. In other words, record how you found the vulnerability, what impact it could have, and the steps needed to reproduce it.
Next, contact the developers, manufacturers, or company responsible for the system. This is usually done through a dedicated contact channel. At Deutsche Telekom, this is bugbounty@telekom.de. The next steps require transparency, patience, and trust - otherwise, the process can escalate at this very point. When you report a vulnerability like this, give those affected adequate time to address it. That means investigating and resolving it, which can take weeks in some cases, or even months for complex systems.
At the same time, the dialogue needs to continue to avoid misunderstandings or giving the impression that reporting the vulnerability achieved nothing. Ideally, both sides discuss the timeline and agree on the next steps, including how to communicate about it. If the company/developer has fixed the vulnerability, or if the agreed waiting period has expired without an appropriate response, it may be time to disclose the vulnerability publicly through other channels, for example, to warn other users. That is fair, too, because there was an opportunity to change the situation. Unless someone finds a vulnerability and, while they are still in contact with the affected parties, the rest of the world learns about it through Social Media. That is more likely to be unfair and no longer has anything to do with Responsible Disclosure. At its core, this is about handling sensitive information confidentially, not punishing developers for mistakes. It is about fostering a culture that learns from mistakes.
Where people work, mistakes can happen. Handling them appropriately is an important part of a shared culture of learning from mistakes. At Deutsche Telekom, we believe in Responsible Disclosure and reward reports through a Bug Bounty program. Over the years, this has given us valuable insights, thanks to the support of talented security researchers. We are grateful to them for helping us improve. Find more information here.
