Not the OP, but I can explain why this decision makes sense to me: Responsible disclosure involves weighing the competing needs of a company (usually reputatio

Not the OP, but I can explain why this decision makes sense to me: Responsible disclosure involves weighing the competing needs of a company (usually reputation hits, increased support demand) with the needs of its users (if they're doing something insecure that they think is secure, would knowing about it allow them to stop being insecure? Will an attacker who reads the disclosure be able to exploit the vulnerability more before it's fixed?). In this case, we have many users who are using a product specifically because they desire extreme security, but due to misconfiguration are getting very little. Worse, the passwords they have been using should be considered compromised, if they are affected by this bug. Having your password compromised isn't something that can be made better for you by a product patch in a few days or weeks. You just need to abandon the compromised password everywhere it's been used as quickly as possible. Since responsible disclosure doesn't help users have their passwords become uncompromised, and since the affected users don't yet know their passwords are compromised, I support avoiding responsible disclosure here. It doesn't help fix the compromise situation, and every hour that users aren't changing passwords actively hurts the situation. The decision is made easier by the fact that there are many users but only one company. You would have to derive a huge positive benefit of responsible disclosure to the company to offset even a modest negative for each user, after multiplying that negative by the number of users likely affected. I think of it as a literal utilitarian calculation. Does that make sense?