I discovered a security flaw in a widely used software that could be exploited by malicious actors; do I report it immediately to the company, or try to 'ethical hack' it to prove the danger publicly?

Umut Yalçın