Sell it to as many customers as you can find first, and then go to them for the extra $10,000. You get more money than you would have otherwise, and you also save innocent people from being unduly compromised. It's a win-win situation ;)
"I have found a critical vulnerability in this application, which I will demonstrate under NDA to any reporter who requires verification. I will under no circumstances reveal this vulnerability to the vendor or to any other party."