Ego, embarrassment, lack of taking someone seriously, ignorance, and laziness all contribute to not taking security reports seriously, and results in creating r

Ego, embarrassment, lack of taking someone seriously, ignorance, and laziness all contribute to not taking security reports seriously, and results in creating rationalizations to prevent fixing them. At that point, you need pressure to create change. Shame definitely works, but it isn't professional, and it isn't nice at all. Many people may be open to help if you can get off of Twitter. You can send a positive letter through a private channel that details the problem and offers help in fixing it. You can make an automated, impartial test that clearly proves the problem and provides links to fixes. Failing these, you can start a petition. You can have famous, well respected, and powerful people sign it. You can add carrots and sticks, like an award for security response, a hall of shame entry, or the nuclear option, a PR release and interview with national media about the dangers of the problem. Even just sending a list of these problems as they have happened in the past and how they resolved to executives at the company is probably all the visibility needed to get the ball rolling.