> ... and you shouldn't expect a warm welcome from the security team. The appropriate response from the security team (after verification) is to pull the site

> ... and you shouldn't expect a warm welcome from the security team. The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.