Be very, very careful - as ANYTHING you do might land you in hot water. Better consult a lawyer before doing anything.

Personal anecdote: some years back, I was working with a major government agency and I uncovered a huge security problem (a print queue was unprotected and any user could read the ultra-secret, world's-fate-altering documents). I promplty reported the issue and, instead of a commendation, I nearly got myself arrested.

Legal aspects and institutional rules can be complex and counter-intuitive - they can punish even the Good Samaritan!

Again: consult a lawyer before doing anything.