I've inadvertently discovered a significant security flaw in a widely used piece of software. Do I publicly disclose it, potentially causing chaos, or report it privately to the company, hoping they fix it responsibly?

Helmi Salo