A penetration tester discovers passwords in a publicly available data breach during the reconnaissance phase of the penetration test. Which of the following is the best action for the tester to take?

Adding the passwords to a report appendix is insufficient; immediate action is required due to the high risk of publicly available compromised credentials.

Doing nothing would be a dereliction of professional duty, as the information represents an active and critical risk to the client.

Discovering publicly leaked passwords of the client's employees or systems constitutes a significant and immediate security risk. The ethical and professional responsibility of a penetration tester is to promptly notify the client so they can take immediate action, such as enforcing password resets, to mitigate the risk before these credentials can be exploited. This prioritization ensures client security above the assessment's technical goals.

While using these passwords for credential stuffing might be a valid next step if approved and in scope, the best first action is to inform the client of the compromise itself, allowing them to remediate proactively.