To me, they made the decision to put all of their clientele at risk. There's no problem with "outing" them. Sure, if you anonymously tell them about the securi

To me, they made the decision to put all of their clientele at risk. There's no problem with "outing" them. Sure, if you anonymously tell them about the security loophole, will this fix future problems? Likely not. I say report them. There's nothing wrong with reporting bad behavior. You're not responsible for the consequences they have to face for making those decisions.