Proper response: "OK, so I found a problem with one of the open source tools we use and I know how to fix it. Do you want me to 1) not fix it, in which case our

Proper response: "OK, so I found a problem with one of the open source tools we use and I know how to fix it. Do you want me to 1) not fix it, in which case our code is broken, 2) put a workaround in our codebase, which you'll have to maintain forever 3) create a fork of the codebase which you'll have to maintain forever, including merging upstream changes, or else forego future bugfixes and improvements or 4) contribute the fix back to the original project on company time, which means you'll never have to pay to maintain that code?"