Responsible disclosure is an unwritten agreement between two parties. If I find a vulnerability in your system, and you don't go out of your way to make it har

Responsible disclosure is an unwritten agreement between two parties. If I find a vulnerability in your system, and you don't go out of your way to make it hard for me to report it, then I will send it to you first. If you show some interest in fixing the vulnerability, I will hold off talking about it for a while. If a company doesn't do their part in making responsible disclosure possible, I don't feel bound by it either. If it's anything big, I'd first report it to the national authorities (CERT, NCSC, ICO if there's personal data involved). Want me talking to you before I talk to the authorities and possibly a lawyer? Provide me with a contact option that doesn't involve agreeing to a small novel's worth of disclaimers.