Free shoes from Skechers, and how to receive a vulnerability report

Shoes for free? Yes, thank you Skechers!

Responsible disclosure is often a thankless duty, because it tends to be met with silence or suspicion rather than appreciation. Researchers who spend their own time helping secure systems frequently run into ignored emails, bureaucratic stonewalls, or even legal threats. Instead of being thanked, you are sometimes treated like a criminal simply for pointing out a vulnerability, especially if the disclosure makes someone look bad or exposes poor practices.

The irony is that you are acting in the interest of public safety, yet you are often met with fear, blame, or legal posturing rather than cooperation or gratitude.

Skechers did the opposite. They were thankful someone reported a security vulnerability, and they showed it. That is the reaction that keeps researchers reporting instead of walking away.

Be more like Skechers.