Hypothetically speaking here....

If i find that a website has a weak password protection to enter it ,can i make this known to the site owner.

Or,would that not be a good idea ?