I had an experience with a major app that had a major 2FA fail. They wouldn't even look at it unless submitted through Hacker One (I was giving them a friendly

I had an experience with a major app that had a major 2FA fail. They wouldn't even look at it unless submitted through Hacker One (I was giving them a friendly heads-up and sought no compensation). I spent hours documenting it, writing detailed descriptions, and making a video of the leak in a live session. They closed the case with a vague (and unrelated) message within 30 minutes of its submission. I deleted their app, never used it again, and don't work with people who do.