I'd either let them know in a straightforward way (email or use contact form to ask how to report a security issue), or not let them know, but I wouldn't try to

I'd either let them know in a straightforward way (email or use contact form to ask how to report a security issue), or not let them know, but I wouldn't try to let them know while hiding my identity. Too much could go wrong. Who knows, your good deed could end up getting you in some trouble. But it's true of any good deed you'll ever do in your life. You can't let the risk of being harmed stop you.