I am not a lawyer but if you know what software they are using and it is open source, submit a non-technical bug asking to file a sensitive security related iss

I am not a lawyer but if you know what software they are using and it is open source, submit a non-technical bug asking to file a sensitive security related issue and then work directly with the project development leaders. Get in writing that you are permitted to analyze the security of their software. If you do not know who develops the software then you could always reach out to the people running the software platform and ask if they have a bug bounty program, without providing any details until they have agreed in writing that you are permitted to analyze the security of their platform. If they do not agree to this in writing, cease all communication with them.