Yeah, I would try and find a reputable security researcher -- ideally, a somebody that has done this type of work before -- and report the issue to them. They can then perform due diligence & official disclosure.