You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.

Would you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it?