There's some great advice here. I'd like to add to it from the prospective of the people at the large internet service receiving the disclosure.<p>Every day they possibly get hundreds of emails to their security@ email address. The vast majority of it breaks down into categories of spam and support requests. Then when you have removed that you are left with a pile of "security disclosures", the vast majority of which are a very poor standard, or generated by some sort of scanner software that's returning garbage results.<p>After this gets filtered the remainder are legitimate issues that need to be investigated. Bear in mind you might not get one of these for weeks and weeks, but you still have to filter the other hundreds of emails.<p>For all but the largest internet companies (think apple and google), they can't afford to tend to this filtering process 24/7. So this happens Mon-Fri during business hours, and if it's a legitimate report it will make its way to a security engineer.<p>So, what am I getting at? You've taken the right steps to report this. What you have described sounds like a vulnerability, who knows how long its been there. Given that and the nature of the vulnerability, the likelihood of this been exploited over the coming days sounds low. So we don't have to go to DEFCON 5 just yet. Don't expect companies to react to these reports within hours or over the weekend, theres just too much noise to make this sort of thing feasible. Please give the company a chance to do their thing, this could take a business day or two, just to get acknowledged. And another couple of days to patch (depending on the technical difficulty).<p>By the way, this is pretty much outlines the value proposition of the Hacker One service[1] and why companies should use them. As bug bounties become more popular, the long tail of garbage security reports will increase and so will the overhead cost to run one of these programs effectively (quick response times, qualified engineers triaging the inbound queue, etc.).<p>[1] <a href="https://hackerone.com/" rel="nofollow">https://hackerone.com/</a>