If you see something potentially vulnerable, you don't have to wait until it's been exploited to report it.
If you see something potentially vulnerable, you don't have to wait until it's been exploited to report it.