During an engagement with a financial institution, a penetration tester found hard-coded credentials in a publicly accessible code repository. Those credentials allowed the penetration tester to…

Proceeding with the engagement without immediate notification of a critical finding like PII exposure is irresponsible and unethical, as it delays mitigation of an active threat.

Keeping and using credentials that expose PII without immediate disclosure is unethical and could lead to further compromise or liability for the tester.

Disclosing findings through a public bug bounty platform before reporting to the customer is inappropriate and could expose sensitive information to a wider audience, violating client trust and data privacy.

Best practice and ethical guidelines for penetration testing require immediate reporting of critical findings, especially those involving PII exposure, to the designated customer contact. This allows the client to take rapid action to mitigate the severe risk and prevent further compromise.