Ask HN: thanks

full disclosure is best.

Make sure you contact them, they could resolve it or already know about it, or at least confirm reciept of the bug.

Publishing publically could put unnecessary risk to abusers.