Hacker News Reader

What is the proper way to disclose evidence for this class of hacking?

Starting with an isolated POC showing the vector being exploited would help. I like gooogle project zero mainly for this.