Its hard to say what your best course of action is without seeing the development agreement. In mainly comes down to whether or not you guaranteed any warrantie

Its hard to say what your best course of action is without seeing the development agreement. In mainly comes down to whether or not you guaranteed any warranties on your product. If you did make such assurances, Your best course of action is to start a paper trail to document your corrective actions(looks like you have already started). Additionally, if the vulnerability is likely to cause damage to the consumer if exploited, you should notify both the customer and the deployment developer in an email. That will at least make the client aware of the problem so they won't be blindsided if it is exploited. Its much better to come clean and fix a small problem now, than it is to ignore it and have the small problem turn into a huge problem. Patches happen all the time.