But I'm also lazy and/or not very good at dealing with large corporations to find the right person to report these things to, even if they have a bug bounty.
Are there any organizations -- uhh, non-criminal organizations -- that will take a security report, find the right person at the company to report it to, see that it is addressed, and maintain my anonymity, so that I can wash my hands of it and go back to what I prefer to do with my time?
they'd need to document these security holes so that the same bug isn't reported several times simultaniously. so, they'll have a database of security holes a documented way to break into them...
this would be more than just a honeypot for every black-hat hacker out there. they'd be swarming them
Based on the numbers I've seen doing contract work for a big blue chip in the UK, you could see it as an opportunity to sell penetration testing services. If this one is unwilling, there could be 5 more willing to pay a good sum to have these sorts of flaws identified and fixed.
I get the feeling a lot of pen. testing companies run a standard set of checks for vulnerabilities. The report I saw was simply a bunch of metasploit results. They were charging some many thousands for this. Offering above and beyond could be a good opportunity.
Merely sending a emails and awaiting a response (if that's what happened) is an ineffectual tactic as it depends on a chain of unaccountable people within the org making the right decision about who to forward the email to.
DON'T DISCLOSE SECURITY FLAWS TO UNWILLING OWNERS.
If you stumble across a security flaw in a proprietary system, check whether they have a bug bounty. If so, great. If not, keep your mouth shut and get on with your life. (Unless, of course, you've decided to sell it on the black market; if you're okay with the ethics of that, so be it. But my advice, that needs to become the standard advice to everyone, is to just keep your mouth shut.)
Don't bite the hand that feeds you - and don't feed the mouth that's going to bite you.