Do they have an email address for security incidents? What about responsible disclosure documentation? Could be a good indicator on whether they value the security report or not.

I'd personally disclose it to them in the interest of protecting everyone else that uses their platform. You have the power and ability to stop what sounds like a pretty catastrophic leak.

IANAL but you're intentions are clearly in the right place, they'd be uproar if they tried to prosecute you...having said that they might still try