Practice by Numbers, a provider of dental management software, has patched a serious security bug that exposed the private health records of thousands of patients.

The bug allowed any user with access to the patient portal to view documents belonging to other users. Patients’ personal information, medical histories and even photo IDs were at risk. Joseph R. Cox, who discovered the flaw, reported it after being unable to contact the company through conventional channels.

This incident highlights a broader issue: consumers often find security flaws in products but lack clear ways to report them effectively. Earlier this year, similar issues were found with fashion retailer Express and Home Depot, where users had to go public to get companies’ attention.

Practice by Numbers has taken swift action, bringing down the portal and notifying affected patients. However, the incident raises questions about whether regular security audits are conducted before software launches, and if companies have mechanisms in place for reporting bugs.