Concerned about user privacy and security — and consistent with industry best practices [link to owasp] — we wrote a detailed email to the Fizz team [0]

Do you disagree that the OWASP page states the below?

Researchers should:

Ensure that any testing is legal and authorised.[1]

Ok, I can see how the OWASP document doesn’t use the words ethic or right or wrong. Would you agree that the claim by saligrama.io that they were “consistent with best practices” (where best practices is a link to OWASP) is not true?

I can see an interpretation where they communicated in line with best practices even if they didn’t follow best practices in their actions before communicating.

0. https://saligrama.io/blog/post/firebase-insecure-by-default/

1. https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability...