I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert them about this problem. But it would be nice if the company let me solve the problems that I identified as freelancer or something. But probably they will contract some security company to do this job and pay an higher monetary value.
Any advice about this subject? What should be my ethical approach?