Just explain to him privately that it's not a good idea and leave it at that.
Ask HN: My CIO put our DB online, what should I do?
11–12 of 12 posts
Re: Ask HN: My CIO put our DB online, what should I do?
#12Please don’t do the “explain it privately 1:1” thing. I know it sounds like a good idea, and I’ve done it so many times, but it’s going to back fire and I’ve never seen it work. Really I’ve never seen it work.
Leak it to some outside source. The local media station, anyone with “security researcher” in their name on Twitter, whatever.
Please feel free to email me too. Check my profile. I can give you stories from previous situations I’ve been in.