I've found a data leak in a fairly well known password manager. I'm currently in talks with the developers to get this corrected. However, in proving that this is a bug I stumbled on a users data which is freely accessible to anyone. All it requires is a simple google search and you can view the data.
Given that I have seen many people in the US (where I currently reside) be prosecuted for simply pointing out security flaws, should I email this random person and tell them that their data is out there for the world to see?