I'd say it depends on what that "security" is. If it is remotely exploitable and can harm user freedom, tell the companies quietly. On the other hand, if it can enable user freedom, keep it to yourself and those who you trust to be on your side.