I am glad I went to a university that reacted appropriately. I found a bad issue (students passwords for system that held their ssns, grades, financial info etc was world readable) and got a pat on the back for them. I went through a prominent CS professor instead of directly reporting it though.