You have every right to look at data going in and out of your phone. This is different from finding a vulnerability on a web site. You can't be accused of "hacking" their web site.

I've had this problem with iDrive, the backup program. If you use their web interface, they send the encryption key to the server as plain text and decrypt at their end, not in the browser. They denied this when I told them about it. I sent them dumps of the web traffic.