You are a security researcher, you've discovered a critical vulnerability inside a small banking android application used by thousands of people daily.
Your proof of concept code allows you to impersonate anyone inside the application (including admins), you have basically access to everything.
How do you report your findings in such a way that the company does not legally whoop your ass in case they feel threatened by your discovery ?