>Demirkapi passed on his findings to his school's IT department. However, it ended up being viewed by every school in his district and he was suspended from school for two days.
For some reason, all students had access to the admin file systems - and for some other reason, the IT people had usernames and passwords stored like that. Either way, he reported the findings to the school admin.
What did the school do? Press charges. Police came knocking on his door, and confiscated his computer.
Keep vulnerabilities to your self.
When I was in high school a few of us grabbed passwords from unencrypted wifi/network protocols (maybe it was POP3 logins, I don't remember) and "reported" it with some harmless website defacing, telling the admin (who was a cool guy). Nothing happened and I don't think anyone ever even noticed.
I was nearly expelled from my high school for finding and immediately reporting a vulnerability, without having actually exploited it. Also my story is far too common. Most of the people in charge don't know anything!
Many of us in the industry who have been around the block a few times support either selling your exploits or open disclosure. We have our reasons.
This even extends into victimless[1] hacktivism. (@see Aaron Swartz)
1. This is my opinion, not a declaration of fact.
My brother had a classmate who ended up being subject to pretty intense investigation for something similar, mostly because the IT guy was incompetent and characterized a problem in a certain way. He wasn't charged, but it cost his family a bunch of money.
I would advise anyone to never volunteer anything of a infosec nature in a public school environment.