Originally Posted by NetRodent

Actually that's the estabished and accepted method of bug reporting. Notify the company privately and if they don't fix it in a reasonable amount of time make the bug public so they have to fix it. Its far better to embarrass the company into fixing the bug than to have someone less reputable discover the bug and be free exploit it indefinitely.