Already, that you have to ask it here shows that there's something wrong.

Let's take a guess, what would be easiest to do:

- talk about it anonymously on some cracker irc channel?

- contact the official channels with the right precautions and the right credentials, to avoid being sued for whatever reason?

Perhaps you should just forget about it.

I would go to the company, and if they didn't respond to the issue, I would do a public disclosure of the flaw.

It's crazy that I have to worry about being sued for pointing out a mistake.

If you are looking for a reward, just ask the company first off if they offer bounties on finding flaws.