I guess if you devote a lot of energy to researching a vulnerability and the developers explain to you that it's not actually a vulnerability, you only have two

I guess if you devote a lot of energy to researching a vulnerability and the developers explain to you that it's not actually a vulnerability, you only have two choices: - Accept that you misunderstood and have mostly wasted your time by pursuing unnecessary research. Refocus on new vuln research. - Become indignant and accuse the developers of being uncooperative and conspiratorial by refusing to validate your research. Double down on publicizing your original research. Which response is correct hinges on whether the developers are justified in denying the vulnerability. As a reader, I was prepared to have the second response but after reading the article I feel the first - this was a waste of everyone's time.