Who is responsible for the security of the Internet project and what actions are taken in response to these incidents?

Question

Information Security

Even if you have a small online store and 2 people work in it, I'm still interested to know your opinion too, maybe it will complement the overall picture.

Let's take a dozen cases in which a strict sequence of actions is observed, regardless of the scale of the project:
1. There is an Internet project on which a serious security problem was accidentally discovered, well, for greater passion, let's say with personal data of users, including financial.
2. Naturally, as normal people without selfish goals, we send a message to the contact email about the error.
3. In the example under consideration, we receive feedback in 100% of cases (in reality this is not the case), in which they thank for the help and undertake to fix everything.
Conclusion: after a few months, the error has not been fixed.

What really happens in such cases? Have you had similar cases? If so, what exactly slows down the process, what are the objective reasons?

Answer 1

The process is slowed down, I think, by the technical illiteracy of the IT service. For example, there is a forum that I often visit. There, for half a year now, there has been a problem with the spread of viruses to mobile devices by modifying htaccess, when mobile clients, based on the User-Agent, are redirected to the URL with the virus.
The forum has nothing to do with IT, so I, as well as a couple of other IT people, who by coincidence turned out to be regular visitors to this forum, gave advice to the administrator several times on how to fix the situation. However, nothing changes. He cleans htaccess, and after a week or two everything returns. That is, a web shell is sitting somewhere, and the admin does not know / does not understand how to find it and how to configure the system so that it does not get there again.
We cannot understand how this is possible, but can you?