Pretend you are going to have a discussion with this person ten years in the future. At that point, you will be free to discuss everything without repercussions.
What will you be comfortable telling the candidate at that point? Here are some possible examples:
"My own experience was bad, I understood others to feel the same way, and I was planning to leave. However, due to the employee-employer power imbalance I feared for my career if I was completely honest about my perception of the lab."
"I did my best to hint to you that I felt the lab was poorly run, but I didn't feel that it was my place to make that decision for you."
What you probably don't want to say is something like "I was scared and I didn't do what I would have liked someone else to do for me in that situation."
If you were really in a highly vulnerable situation, I would not hold you accountable for what you felt you had to conceal/not reveal. So if that is really the case, I think you can be comfortable protecting yourself. That's the point of the first couple of responses I typed.
In a situation like this, the ethics are not straightforward. Am I ethically obligated to sacrifice my safety for the benefit of someone else? One can come up with any number of situations where it would be very, very difficult to make a blanket declaration that X is the right decision.
My personal approach has been to accept some risk to myself in order to help other people. Sometimes that has had negative repercussions for me, but I felt good about the decision and pushed forward through those situations.
I agree with other suggestions that you might want to give hints in such a way that you do not expose yourself to legal action but which you can reasonably expect that the candidate will understand.
"Just as personal advice, I highly recommend that before you join any lab you do your best to read between the lines to get an idea of what the culture might be like there. People don't always feel comfortable saying exactly what they think in formal situations like interviews."
That is, technically, just true advice (in fact, very good advice). If you are challenged on it, you can play dumb. "What? I was just giving him personal advice, do you disagree with anything I said?"
Conversationally asking about other opportunities they might be considering and asking how they assessed the culture there (if they've already interviewed at any of them) might give you cover to comment about the fact that it can be hard to tell what the culture is in a lab because people don't feel completely free to talk about it if they think it's bad. Then you have cover by saying that you were talking about the other opportunity.
"I don't want to say anything bad about the culture here without the person being in the room to defend themself." True statement, they should be able to pick up on it.
To protect yourself it might be worth rehearsing a few lines like this and keeping the phrasing in such a way that you can accurately say "I never said anything negative about the lab here." Phrase all your comments in such a way that that is true so that you can confidently state this should the candidate (intentionally or not) blow your cover.
Here are some other true statements:
"It's not my responsibility if the candidate misinterpreted what I said [this is true--even if you actually intended them to interpret it badly and the candidate accurately interpreted everything, it's still true that it's not your responsibility if they misinterpreted it]."
Is your lab on Glassdoor? If so, put what you really think on Glassdoor (it's anonymous--but make sure that you don't say anything that makes it obvious that it's you. Note, however, that if the lab is small it may compromise your anonymity. Only take this option if you can be reasonably sure that it won't be traced back to you, which is probably only true if there are hundreds of people that could have written the review you wrote. [this caveat is a reaction to a comment on this question by Bob]). Then you can casually mention (in the context of that conversation about what other opportunities the candidate might be applying to, for example), that Glassdoor was originally mostly about corporate environments but now some academic labs are on there and that you always check Glassdoor before you accept an offer.
Another example of a true statements that is not directly about your lab:
"People are often under a lot of pressure to keep a lid on a bad situation. If there is bad leadership, it's even worse, because they probably can't trust that bad leader not to retaliate."
Your defense, if cover is blown by candidate: "We were just talking about the academic interview process in general. I was trying to build rapport [true statement!]. I didn't say anything negative about the situation here."
In the end, no one can tell you what the appropriate amount of risk to take is. You want to make sure that you feel good about how you handled yourself. You should look for a way that you feel is the right balance between courage and caution for your particular situation at this time. You are a person with particular vulnerabilities at this particular time. The candidate is a person with particular vulnerabilities at this particular time. You would have to be omniscient to know what the exactly correct balance is. You are not omniscient, so you are going to have to make a guess. Do your best, with the emphasis on how you think you will feel about your decisions in ten years, and recognizing that you are fallible and your approach will not be perfect, and that's ok.
