First of all: congrats for finding it and kudos for asking for advice on how to deal with the issue.

If your doubtful about what way of disclosure would be the most prudent (and you sure don't want the disclosure to backfire on yourself) get in touch with someone who's bigger and has lawyers backing you up (like the EFF but that's just the first idea that popped into my mind, any tech news site might even pay you for exclusive coverage)