I once found a state website exposing info they probably (?) shouldn't have been in some JSON fields. The sensitive data was not shown on the rendered page but it was in the browsers memory all nicely formatted. I thought of reporting it, but thought it was more likely they would try to save face by accusing me of being a hacker because I pressed F12 (and that I might have to fight charges in a far away state), rather than accept their mistake.

I chose to stay quiet.

I guess I'm not the only one to have faced this dilemma.