Ask HN: Is there "security issue notification for dummies?" (I discovered a hole...now what?)

Pardon me for this question, but I recently discovered a major security issue in OpenWebmail (it gives out full access to users' mailboxes in referrer URL), and I don't know how to handle it. How should people notify security professionals about such issues? I notified one of the providers that uses OpenWebmail about this, and I tried to find contact information on OpenWebmail website, but couldn't. So my question is: how people outside the security community should handle important security information? Should we disclosure it? Should we notify security experts? Websites? Maybe I did a mistake writing about it? :-) I don't know. Please educate me. Thank you!