Hmmm...that's troubling. Are you sure they understand the ramifications of the bug? Let's assume they're rational actors and for some reason have made the decis

Hmmm...that's troubling. Are you sure they understand the ramifications of the bug? Let's assume they're rational actors and for some reason have made the decision that this particular bug is lower priority than whatever-else they're working on. I think your challenge is to thoroughly/patiently explain why this bug is important and actually worth looking into. But I doubt it's worth losing your job over, so once you've asked twice, I'd probably drop the issue. If the vulnerability ever gets used by an attacker your multiple disclosures will come to light, and hopefully they'll pay more attention to you next time. Some people would rather learn lessons the hard way, and it's not always your responsibility to save them from themselves, ya know?