Haven’t we learned this lesson well enough yet? In the 21C, if you learn about a potential security flaw, under no circumstances should you report it to corporate security people. Remember, their job is not to safeguard data - their job is to keep their job.
Therefore, the only sensible thing to do is to contact the Russian Mafia, whose motives are crystal clear and who can be trusted to reward you appropriately.
