This question already has an answer here:
I was reverse engineering our school's commercial grading system backend with chrome dev tools observing the GET requests. My intent was to code a nice app, just for me to learn more about this etc.
I have come to discover that you can see any student's information by just POSTing to the server with their student id information, which is included in every student's email. And our school's email address book is easily visible. The really bad thing about this is that the request returns the student's social security number as well. How would I go about disclosing this to the vendor and the school?