I found exposed personal data. Then things took a turn.

You discover a website with a serious security vulnerability. There's no security.txt, but there is a contact page—and a misconfiguration appears to expose personal data: email addresses, phone numbers, and social media accounts.

What do you do?

1. Quickly report the vulnerability using the contact address listed on the site?
2. Dig into the exposed data to find out more — knowing full well you may be crossing a legal line?
3. Do nothing and move on?
4. Or, as a joke, of course, try to sell the data on the dark web?

What would you do? Tell me in the comments — and why.

The full story — and the uncomfortable questions it raises — coming soon.