Everyone here seems to be saying "oh god, don't do it, CFAA!" Respectfully, this sort of fear is what holds the Internet back. You are incredibly unlikely to g

Everyone here seems to be saying "oh god, don't do it, CFAA!" Respectfully, this sort of fear is what holds the Internet back. You are incredibly unlikely to get sued unless: you are threatening to disclose publicly, you intentionally stole data from the site and are storing it now, you threaten to sell said stolen data to a journalist or anyone else, etc. It costs companies, generally, a lot of money to sue someone. They aren't interested in doing it unless you seriously piss them off or actually cause their business/revenue harm. If you are not weev, trolling them publicly and saying you'll sell their data, you can likely disclose and be fine. Just be nice about it. By being nice, I have disclosed hundreds of vulnerabilities over the years, in this manner. Sometimes they even let me write a blog post about it afterward. If you want, email me and we can discuss in more detail. Email is in my profile. tl;dr: find someone to contact via LinkedIn or email (CISO or CTO usually works well), be incredibly nice and non-threatening about it, and you'll be fine.