That's starting to sound quite close to blackmail. "I have remote code execution in your product, pay me XXX or I'll tell everyone". I don't actually know if

That's starting to sound quite close to blackmail. "I have remote code execution in your product, pay me XXX or I'll tell everyone". I don't actually know if it is blackmail, but if it is, hiding behind a union isn't enough to make it not-blackmail.