I'll second this. If they have any sort of security program, go ahead and report it to them. Otherwise, it is a bit more risky. Personally, when this has happe

I'll second this. If they have any sort of security program, go ahead and report it to them. Otherwise, it is a bit more risky. Personally, when this has happened to me in the past, I just send an anonymous email (over tor etc) to security@example.com and leave it at that.