It is unlikely that you can legally make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability.
Note that in the US, hacking is illegal. The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal. I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal. If your actions in discovering the bug violated the law, even arguably, and if you piss off the company or generally act like a jerk (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you for violating federal law. You really don't want to be in that position.
In general, it is rare for companies to compensate people who report security bugs to them. A few companies (e.g., Google) have "bug bounties" programs, where they promise to pay a few hundred or thousand dollars to people who report serious bugs to them under their program. But most companies don't do anything like that.
Generally speaking, here is my advice:
Have you ever hacked, or tried to hack, this site? Did you try anything that could be characterized as unauthorized access or an attempt to attack the site? (e.g., typing in a single quote to see if it is vulnerable to SQL injection, sending < to see if is vulnerable to XSS, etc.) If yes, stop here. Don't disclose the vulnerability to them yourself. Give up any thoughts of making money. If you want to do the morally right thing, you could contact an adult you trust and ask them to report the vulnerability on your behalf without disclosing your identity -- but don't expect any payment.
If you are confident you have never done anything that could be characterized as attempting to gain unauthorized access or otherwise attack the site, and you are confident nothing you've done is likely to be treated as a violation of federal law (e.g., CFAA), then you could consider how to report the vulnerability to the site, if you wish. But don't expect to make any money off this. Don't demand compensation. Don't threaten. Don't ask for compensation as a condition of disclosing the bug. Don't expect compensation. If you are doing it in hopes of making money, stop: set it aside, because you don't want to be accused of extortion, and you have a lot more to lose than to gain.
If you want to disclose the vulnerability, I would try to find someone you trust who has worked in a professional business context for many years. Ask them to help you disclose the vulnerability. Ask them to help you write a letter or email that describes the vulnerability. (I would disclose the vulnerability in writing, e.g., an email, a written letter, not by phone or in person.) Also, before doing any of this, have them read this thread and the following threads on this site:
The reason I suggest having someone else help you disclose this is because there is a significant opportunity for misunderstanding. You want someone who has worked in business to help you craft the letter, to make sure it is taken seriously, and to make sure the company doesn't treat you as a threat and start coming after you with threats of a lawsuit or prosecution. Big companies have entire legal departments full of lawyers who exist solely to protect the company's financial interests. If they perceive you as a threat, they may use every legal resource they have to try to prevent you from embarrassing the company. Someone with more experience in a business context can help you protect yourself.
But, the bottom line is: check your motives. The only reason to report the vulnerability to the company is because "it is the right thing to do" and for the good of others. You are not likely to make money off this, I'm afraid to say this. If you find that you are doing this for purposes of making money, stop; go do something else. If you are doing this for purposes of making money, the risks are too high that you will find yourself hit with a lawsuit, a criminal prosecution, or something else that not only prevents you from making money, but also makes your life hell. There have been too many other cases where security researchers were prosecuted for "hacking", when they were just trying to report or publicize a security vulnerability (not even try to exploit it for financial gain).
P.S. Here is Dan Kaminsky's informal, not-to-be-taken-too-seriously, summary of how things tend to work today:
