Please report them; they're helpful. But there's a huge difference between finding a vulnerability, stopping, and reporting it, and finding one and continuing to dig.

If you report it immediately, often you'll even get asked to dig further; but doing it on your own without authorization is the problem.