jcmcb, yes, of course... If you cost them money or cause them damage then you get what you have coming to you.

But if no damage is done, and you didn't cost them anything, and something so simple as having directory browsing enabled is found... Should you get in trouble for notifying the company? Having directory browsing enabled for a database directory is chaos waiting to happen.

I would be extemely happy if someone notifyed me of this before someone downloads the databases and use my customer's credit cards. That's why I say "where is the line drawn".

In a society where people are getting sued for giving someone the heimlic (sp?) manuver to save their life, but in the process accidently hurting them... I choose to keep my mouth shut about what I find.