[eerikkivistik]

I would even suggest that the lawyer contact the company on your behalf without revealing your identity. I've seen these things go sideways and if you really want to disclose, make sure your identity remains anonymous until they explicitly agree not to pursue any legal action. I'll also add that they might behave irrationally - it can take many forms (denial of a security issue, legal action, defamation of character). But I might be a bit cynical as well, been down this road in the past.