body: Scenario: I shop at a local retail store. While I am there, I notice that store staff have printed out and placed a long list of cleartext credentials for major internal and external business systems, in plain view of customers.
  
  
  Question 1:
  If I take a photo of this list, redact the business name/brand, all passwords and any personally identifiable usernames (or usernames that identify the business), am I opening myself upto a lawsuit for posting this on social media to use as an example of poor security practices?
  
  
  The only thing identifiable from this post would be the type of store and the city that the store resides in (franchise).
  Consider that although I have redacted to the best of my ability, someone may read the post and decide to hunt around the area for a store that matches the photos, then find the list and act on it with malicious intent. 
  
  
  Question 2:
  If I do post this list on social media with the aforementioned items redacted, am I legally required to notify the business first in order to give them a chance to take the list down? 
  
  
  
title: Am I required/permitted to disclose a security risk at a company I do not work for?