My kid's school uses a 3rd party for handling tuition and fee payments. I've just realized that their password security is abysmal (they sent the password to me by both snail mail and email. When I changed it, they displayed it on the web page).
I'd like to ask about what regulations they might be violationing (Sarbanes–Oxley, maybe?), and what I can/should do about the problem. Is such a question appropriate for security.stackexchange.com?
If it's not appropriate here, where would an appropriate site for such a question be?