Why would you bring this to your manager instead of trying to find a way to report it directly to the competitor, anonymously or not? If a bug bounty seems like

Why would you bring this to your manager instead of trying to find a way to report it directly to the competitor, anonymously or not? If a bug bounty seems like a conflict of interest, refuse it. From the perspective of the competitor, this was an unreported security vulnerability. Of course they were going to find out; if I logged in one morning and the DB table that's supposed to be nearly empty suddenly wasn't nearly empty anymore, that's alarming! So much here is just an absolute wild failure of judgement.