Users of the service were not affected by this vulnerability, it had no personal data or something. The only people who could be hurt by this vulnerability is

Users of the service were not affected by this vulnerability, it had no personal data or something. The only people who could be hurt by this vulnerability is the project owner. Disclosing this vulnerability would only make it worse for the project owner, and would not do good to anyone (except cracker who might want to use the server to send spam or something). This post did no good to anyone. It's lose-lose. That's why this post is wrong.