Google "responsible disclosure". The normal process is to inform their security contact (or more likely tech support), give them a number of weeks to reply and

Google "responsible disclosure". The normal process is to inform their security contact (or more likely tech support), give them a number of weeks to reply and sufficient time to fix the issue. After you've given them a chance to address the issue feel free to publish a report.