Just inform the developer outright. No need for secrecy. You are doing them a considerable favor. Tell the developer you will publish these vulnerabilities to

Just inform the developer outright. No need for secrecy. You are doing them a considerable favor. Tell the developer you will publish these vulnerabilities to the public in 3 months. https://en.m.wikipedia.org/wiki/Responsible_disclosure https://en.m.wikipedia.org/wiki/Responsible_disclosure So long as you are not asking for any kind of compensation you are in the right. The moment there is a question of compensation the subject changes from responsible disclosure to extortion.