Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore.
If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.
The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?
They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.
I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.
Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
> The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit.
What?
http://www.senseaboutscience.org/data/files/A_quick_guide_to...
> Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects.
http://en.wikipedia.org/wiki/English_defamation_law
> Allowable defences are justification (i.e. the truth of the statement),
Edit:
http://en.wikipedia.org/wiki/Defamation_Act_2013
> and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),