First State Super, the company that called the police and fired off legal threats when a security researcher notified it of vulnerabilities in its online funds management application, is reportedly softening its stance. According to Australia’s Financial Standard, the company has decided against further legal action, and instead is setting up a meeting with Patrick Webster, who notified the company that its use of direct object references in the URL bar meant any logged-in user could view other users’ information merely by changing the ID number. After originally welcoming the notification, the company then called police and sent legal letters threatening Webster. ...