I'll second this. If they have any sort of security program, go ahead and report it to them.
Otherwise, it is a bit more risky. Personally, when this has happened to me in the past, I just send an anonymous email (over tor etc) to [email protected] and leave it at that.
[Assist]
I'm a Python programmer with years of experience with Python and Flask. I also am experienced with cyber security work and reporting vulnerabilities.
So if anyone needs help with either cyber security on their website or Python, tell me!
Otherwise, it is a bit more risky. Personally, when this has happened to me in the past, I just send an anonymous email (over tor etc) to [email protected] and leave it at that.