Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
1 of 2

You may be on really thin ice if you disclose anything. You may get into real trouble for that.

There is a reason for companies having rigorous agreements between eachother when pentesting is contracted. The pentesting company need all the protection they can get. Disclosing information you should not can and will get you sued or prosecuted.

Lets say you go to the marketing guy's boss. The boss clamps down on the marketing guy. The marketing guy begins to cover his ass. He may persued the boss that in order for you to have this information you must have done something illeagal, or similiar. Even if you will eventually win, you might be in court for a long time.

If they dont want to take it seriously at first approach, pressuring them to taking it seriously will most likely get you into trouble.

For your sake drop it.

EDIT: Furthermore, if the original agreement for the security audit includes specific people you only may inform, informing other in the same company, not included in the agreement, might get you into trouble.