So the question is why don't companies have infosec individuals seriously looking into issues raised by a user seriously because its in their best interest to a

So the question is why don't companies have infosec individuals seriously looking into issues raised by a user seriously because its in their best interest to avoid bad PR and public shaming which will be the logical next step if they ignore it. Is the shaming necessary? Do corporations only respond to an issue when it blows up? Seems like bad stewardship.