I agree with this 100%. If you absolutely must disclose the vulnerability to them, consult with a lawyer. Otherwise, forget it ever happened. EDIT: Depending o

I agree with this 100%. If you absolutely must disclose the vulnerability to them, consult with a lawyer. Otherwise, forget it ever happened. EDIT: Depending on what potentially-logged http requests your curiosity lead you through, you may want to pursue the former.