I keep coming across vibecoded NextJS websites with massive vulnerabilities - how do I report this?

A while back I started a hobby of digging into the source code of websites I suspected to be vibecoded and I was horrified by what I have seen. Hardcoded API keys and admin credentials, completely exposed API endpoints allowing me to modify content (did that by mistake, never did it again), exposed