Rule of thumb is to notify them and share your intent of public disclosure within a certain time frame. Typically 90 days. That's exactly what happened with Zo

Rule of thumb is to notify them and share your intent of public disclosure within a certain time frame. Typically 90 days. That's exactly what happened with Zoom. They half ass fixed it, then it went public and it was fixed in one day.