I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not give specific details about the site.
I found a trivial reflected XSS on one page when I followed a broken link and saw that a URL parameter was reflected in the HTML. I dug some more and found a few other reflected & stored XSS holes. I looked for contact information on the site, and found the email of the admin and a page about the site's security.
On this page, the owner bragged about the security of the site, making some claims irrelevant to XSS. The owner also said that if you even attempt to hack the site the owner will tell the FBI and I don't want to get in legal trouble for submitting a security hole. The owner also claims that the site is valueless to anyone who breaks in because no important data is stored. However, the site has a login with usernames and passwords, and XKCD #792 tells us that stealing passwords is a very big deal.
The security page also claims that text is well sanitized and unsafe text is stripped. However, the only adjustment I had to do to get reflected & stored XSS was to make the HTML tags uppercase (lowercase tags were stripped, possibly in an unsafe way.)
I am unsure about how to report a security hole to this website without getting arrested. What should I do?