Is there "security issue notification for dummies?" (I discovered a hole...now what?)
cperciva: Generally the best approach is to contact someone who is part of the security world -- they'll both know how to approach the right people and have the credibility to get people to listen.