This question already has an answer here:
While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place.
I was trying to hack my friends account. I wasn't planning to do anything with it. I was just very curious and wanted to try something. I didn't think it would work because it was one of the big companies in the world. However, it did!
I know, what I did was wrong and I will never do it again but for now what should I do?