This is a legitimate question to ask before going ahead with matters like this. Reporting security vulnerabilities does come with risks and should be evaluated

This is a legitimate question to ask before going ahead with matters like this. Reporting security vulnerabilities does come with risks and should be evaluated carefully.