Contact a lawyer who represents clients for this sort of thing (if such even exists). The company in question — who knows how they will react. Even if we (all of us here on HN) know your intentions are noble, your discovery may inevitably lead to someone getting fired over this. That person may very well portray your hacking as malicious and try to divert the blame on you. Better safe than sorry.