There is a risk of leakage of credentials and private data. Delaying disclosure does not reduce that risk in this situation; if anything it increases the risk.

There is a risk of leakage of credentials and private data. Delaying disclosure does not reduce that risk in this situation; if anything it increases the risk. People delay disclosure when disclosing early would increase risk. That is not the case here. > If it's a security issue, then responsible disclosure. No. Immediate disclosure when it is the right thing to do. Delayed disclosure when it is the right thing to do. > If it's not a security issue, then it's not 'Security'. Right? Yes. If an issue is not a security issue, then it is not a security issue.