One way to get it fixed quickly is to drop the exploit publicly with a basic PoC. You've tried a responsible path and it's wasted your time. There aren't laws

One way to get it fixed quickly is to drop the exploit publicly with a basic PoC. You've tried a responsible path and it's wasted your time. There aren't laws mandating "responsible disclosure". It's a professional courtesy. The irresponsible party is the entity operating the service without a security@ email address. Lots of bad actors could easily find this vulnerability independently (probably already have). This means all the service's users are continually at risk right now, every second of every day as long as this doesn't get resolved