Ask HN: How do I disclose bugs to a company without a bug bounty program?

As anonymously as possible, IMO.

> I am reluctant to email their customer support.

If this reluctance is out of security concerns, you could always ask for the best contact method to report security vulnerabilities without disclosing the vulnerability to that email.

Plugging their website into https://whois.icann.org/ may give you some alternative contacts if you just hate customer service.

Even though you're reluctant to email their support, you can contact them without disclosing the specific issue and just ask for their security contact (or a person who is authorized to handle this kind of issue). An alternative is to contact them by phone number, if they have one readily available. Also what MaulingMonkey pointed out, you can see if the whois gives you any more contact info.

You could contact a well known security expert that does this kind of stuff professionally, unless you want to make a name for yourself.

Post the exploit here. It will get to where it needs to go... eventually.

Try emailing the CIO/CTO direct. You can look up his address here > https://emailhunter.co/

Don't. Hold them for ransom. Why do you want to do charity work for for-profit businesses?