Can any Ethical hackers in this community answer: 1. How should I go about reporting a vulnerability in a website/app? 2. What are the positive/negative effects?

Contact the team directly, support Mail, social media or bug reporting pages. If they don't respond, threaten to make it public info, that usually gets their attention. Positives- you can get recognition/money Negatives- you can get ignored and your time will be wasted

check if the website is enrolled in the hackerone.com create an account there and submit the vulnerability