It should always be the sane thing to report to them about this vulnerability. White hat, man.