The right thing to do is follow Responsible Disclosure

https://www.bugcrowd.com/resource/what-is-responsible-disclo...