What is the most responsible way of disclosing an open AWS S3 bucket?
Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it belongs to a specific company. Would you reach out to the CISO/CTO at that company with the name of the bucket and recommendation that it be looked at immediately?
I've looked through a few answers here (including How to disclose a security vulnerability in an ethical fashion?). Are S3 buckets more complicated in that they don't have a clear owner?
Are there other security complications if the data was already downloaded automatically to another location? (common with brute force scripts that I've seen on Github for finding open S3 buckets is automatically downloading the files if the bucket is open)