I am curious: What is the right protocol about telling that you were able to locate an egregious security flaw on a public server? Should I go ahead and tell t

I am curious: What is the right protocol about telling that you were able to locate an egregious security flaw on a public server? Should I go ahead and tell the company? And possibly get sued anyway? Do I have a right to show it to my friends or journalists? Or should I just shut up and pretend that I have never seen this security problem?