To add some context, the affected software is a company's proprietary, closed-source website. In this case, there is no way of doing a full disclosure without

To add some context, the affected software is a company's proprietary, closed-source website. In this case, there is no way of doing a full disclosure without making it somewhat easy to attack. Even if I only warned the media about this (without even mentioning the "how"), it would make someone else find the flaws in a matter of hours (attack surface is limited) and likely start exploiting them anyway. I really don't want to publish anything; even my data would be exposed and there's nothing I can do about it.