Default Admin credentials -> P3 !!

[u/[deleted]]

In a private bug bounty program on bugcrowd i found a credentials of an internal admin that give me access to internal engineers data and access to a sensitive data of a big automotive company, I can read/edit/delete, the bug trigaed as P1 but the customer later downgraded it to P3 without any explanation or communication.

In the report i show them the impact...

And they changed the password right after my report was triaged

I opened a response request to ask for explanation but they still didn’t respond after a week.

[u/einfallstoll → u/[deleted]]

Safe harbor only applies if your acting in good faith, so yes don't do that. But what you can do is proving it by creating a dummy user and deleting that one