[loumf]

You could contact a legitimate security firm that buys vulnerabilities to get the credit (and knows how to report responsibly).

You want one that immediately discloses and does not resell.