German security researchers at risk of prosecution for “hacking” because of a plain text hardcoded password?

A report highlights a case in Germany where a developer was convicted of hacking after discovering hardcoded MySQL credentials in an application and responsibly disclosing that the vendor’s database exposed multiple customers’ data. The vendor fixed the issue but pursued charges, and the court ruled that the mere presence of a password constituted a protection mechanism that was circumvented. This outcome raises concerns about chilling effects on legitimate security research under German law.