I would think any general contact form that merely opens the conversation would be reasonable (mailto:hello@example.com?subject=how+to+contact+your+security+tea

I would think any general contact form that merely opens the conversation would be reasonable (mailto:hello@example.com?subject=how+to+contact+your+security+team) as would checking the major bounty websites for a listing -- not that you would be shopping for the bounty, but because that's where a receptive audience would already be listening for such reports As for whether to publish a fixed vuln, I would guess that boils down to whether you value the blog traffic and any commentary enough to wade into that. In my mental model, so long as your research was your own, then you generated that content and have every right to talk about it, perhaps even inspiring other non-traditional security researchers to try their hand, too