I think it's a reasonable progression if the company refuses to accept that the exploit is valid and won't open up equable discussion about it. Trying to force

I think it's a reasonable progression if the company refuses to accept that the exploit is valid and won't open up equable discussion about it. Trying to force someone to sign an NDA is not really acceptable behaviour when someone is going out of their way to help the company (and their customers).