Checkout the FAQ by the EFF on responsible disclosure. https://www.eff.org/issues/coders/vulnerability-reporting-faq#faq2 https://www.eff.org/issues/coders/vul

Checkout the FAQ by the EFF on responsible disclosure. https://www.eff.org/issues/coders/vulnerability-reporting-faq#faq2 https://www.eff.org/issues/coders/vulnerability-reporting-fa... Key points: document absolutely everything, allow reasonable amounts of time to fix (ie multiple weeks), don't ask for anything. Even then you might choose to ignore the issue and walk away, lest they sue you for exploiting it. Before revealing the bug TALK TO A LAYWER or at least contact the EFF to get advice.