I found a reasonably severe security flaw in the website of a reputed firm. Whom should I contact and how do I get their attention? Should I exploit the vulnerability and document it with screenshots as proof?
valid question