Ask HN: How do I report a security issue without getting sued?

I have noticed a security issue on a certain webpage. The impact is quite severe - there is user data (Credit Cards information) leaking and a user without valid credentials can access information for assumed logged in users (like Forum comments). I have not tried to create or update any information on this website. I am not a Security Researcher, White Hat or any color Hat Hacker. I am just a Webdev from next door. So my question is: How do I report this issue to the website owner without getting sued? The website contains a disclaimer that forbids "Breach or otherwise circumvent any security or authentication measures". This is actually not necessary - since there is no working security or authentication measure. But still - how does one approach this properly?