I'll second the question, but for a different reason. I once noticed a vulnerability on Facebook, and as a responsible citizen, took screenshots of what was hap

I'll second the question, but for a different reason. I once noticed a vulnerability on Facebook, and as a responsible citizen, took screenshots of what was happening and wrote a friendly email explaining how it could be used to compromise another user. I explained that I had just stumbled across the problem and wanted to be sure they knew it was there, and how to fix it. Their response was to lock my account for a day for "suspicious activity". Once they unlocked it, they changed my password and informed me that I must have carelessly given my credentials to an attacker (which had nothing to do with the problem I reported). Their email was extremely rude and threatening. As a result, I would never dare inform the financial institutions of their problems unless I worked for their security team, for fear of being prosecuted. So as a follow-up question: what has been the response you've received in the past from such action? And indeed, how do you avoid coming across as a malicious hacker?