Release it, in order to force a fix. If they won't do their due diligence and it's possible to exploit, nothing stops a malicious actor from taking advantage if

Release it, in order to force a fix. If they won't do their due diligence and it's possible to exploit, nothing stops a malicious actor from taking advantage if they discover it. In the case of public disclosure, it forces them to acknowledge and fix the problem.