Ask HN: I found a security bug. Should I report it?

Disclaimer: English is not my native language and I'm not that good at writing.

Backstory:

I was checking my account on the website of a well known computer-related company (I'll keep it anonymous for now) and I found out that they were giving away some games for those who purchased some piece of hardware of a another brand.

Long story short I found the username and password of their sendgrid account (by decompiling one of their programs) and was able to login successfully.

Why am I asking this question? Well, I don't want to be sued for hacking since I'm a student and I don't really have the money/power to defend my self.