2. Ask to speak to a representative of the people developing the thing on the telephone.
3. Between the two of you, figure out who to tell next.
4. Realize that other people may find the bug, too. You have some time, but not infinite time.
Now, if you want a bug bounty, you have to file a report and wait a certain amount of time before you are allowed to disclose.
