Noticed a local municipal website is vulnerable to SQL injection. I'd like to responsibly disclose this to them, but am also worried there's like a 20% chance they'd panic, think I hacked them, and arrest me.
I know a lot of local municipalities contract out their IT services. Their webpage may say who is running their infrastructure. Or...do what I did when I used to sell said IT services. Get a meeting with them and do a live demo of exactly what could happen if they don't fix it.
