Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending o

Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case. As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.