IANAL. If you have reported the vuln they are required by law to report a "breach" to the authorities and if they do not do it willingly they might be forced to

IANAL. If you have reported the vuln they are required by law to report a "breach" to the authorities and if they do not do it willingly they might be forced to tell all their customers about the breach. There's really no good in telling your 70k followers that said site has vulns, at least not until they have fixed them. If moths have passed, the vulns are still not fixed and you have not heard back from them you could try contacting the authorities yourself. Self publishing your own "hacks" are not a good idea though, you should get a newspaper or other "researcher" to do it for you. You can brag about it later when the vulns have been fixed and you got permission. Only try to hack those who have asked for it, and make sure you join their bounty program for a reward.