Wow, the author is very naive. Did you really think anything good would come out of you telling this to your employer? Your do not owe them anything you do in your spare time, unless there's some contractual obligation. Companies are just looking after themselves, and will quickly throw you under the bus. I am very paranoid with that.

I used to explore APIs and do this sort of digging for fun, even though I was employed. My approach was the following. If the company had a decent bug bounty program, I'd be happy to report it there, it's the safest way for anyone to do that. If there was not, I'd try to sell it to an "alternate buyer", which is less preferred. I never many things worthwhile reporting though.