Proper etiquette is to report a potential vulnerability through the appropriate channels, give them sufficient heads-up that you will publish your findings and then go ahead and do a write up.

Ideally, your startup is related somehow so you can take this opportunity to get people curious enough to check it out and drive some traffic.

I always like a good story about how people find new vulnerabilities and if it's written well would definitely read it and probably click through to your startup.

Your efforts are much better spent on your startup than trying to find short term hacks.

Also, I'm not a lawyer and this is not legal advice.