pitchit

I'll second this. If they have any sort of security program, go ahead and report it to them.

Otherwise, it is a bit more risky. Personally, when this has happened to me in the past, I just send an anonymous email (over tor etc) to security@example.com and leave it at that.

[Assist] I'm a Python programmer with years of experience with Python and Flask. I also am experienced with cyber security work and reporting vulnerabilities.

So if anyone needs help with either cyber security on their website or Python, tell me!

Good point, I realized that this would need to be a bit more organized. See the updated post.