It's not clear if the author reported the newly found vulnerabilities, though. I think most security researchers agree that public disclosure is the only recou

It's not clear if the author reported the newly found vulnerabilities, though. I think most security researchers agree that public disclosure is the only recourse if an entity repeatedly refuses to acknowledge or fix a serious vulnerability. But you have to give them fair opportunities to understand and try to address the vulnerabilities before resorting to that.