thanks

Make sure you contact them, they could resolve it or already know about it, or at least confirm reciept of the bug.

Publishing publically could put unnecessary risk to abusers.

full disclosure is best.