AI Dungeon isn't an individual, it's a business that charges people money to use their product. In the vast majority of cases, responsible disclosure means firs

AI Dungeon isn't an individual, it's a business that charges people money to use their product. In the vast majority of cases, responsible disclosure means first telling the developers so they can patch the vulnerability. After it has been fixed, unless there are special circumstances, the fact that there was a security flaw should be disclosed to the public. The purpose of this should not be to shame the developers or anyone else, but to inform the people using the product that there's a chance their info has been compromised. I'm mostly just surprised that AI Dungeon chose not to disclose the first instance of this flaw.