Who to write about VK vulnerability? And is it worth it?

Question

API

Good evening.
The fact is that I recently began to study the VK API and found a bottleneck in the entire system, which, it seemed to me, could be exploited mercilessly to gain control over the account. Even wrote for the purpose of the experiment "minivirus". Everything works, moreover, in my humble opinion, it should not be so.
And now, in fact, the question is: to whom to write about the vulnerability? I read on Habré that the support does not take note very well, not to mention the fact that they make any incentive payments, but I did not find any official program for reporting holes (except for the API bug tracker, but it can be ignored). And does it make sense to prove that the vulnerability exists, and if so, how to do it? The fact is that in order to operate it, the "minivirus" needs a one-time (that is, it only works once for a couple of seconds and cuts itself out) access to a computer that has a browser with a VK session. Actually, can then the vulnerability be generally considered as a vulnerability on the VC side?
I will be grateful for answers and advice.

Answer 1

"According to the rules of the Google project dedicated to finding vulnerabilities in popular software, information about the "holes" found is published 90 days after it is discovered and the developer is notified - it does not matter if he released an update or not." Someone does it...

Answer 2

Is this vulnerability only in VK, or in all sites? If only in VK, then, obviously, it is worth writing.
I think they will react adequately, only there seem to be 2 supports: one for the "commoners", the other for technical issues. You in the second.
I don't know about the reward. Judging by the description, not such a critical vulnerability - access to a computer is needed. Maybe a few thousand votes. (one vote - ~7 rubles for replenishment and ~3.5 rubles for withdrawal from VK)

Answer 3

Is it a vulnerability at all? If you need access to a computer, a browser with a session, then most likely this is not a vulnerability.

Answer 4

habrahabr.ru/post/257951

Answer 5

habrahabr.ru/post/259137