I notice the author is in London. For people in the US, my suggestion is to go instead to https://www.cisa.gov/report https://www.cisa.gov/report to report thi

I notice the author is in London. For people in the US, my suggestion is to go instead to https://www.cisa.gov/report https://www.cisa.gov/report to report things like this. Especially when you're dealing with a company that doesn't have a clear vulnerability-disclosure process, or if you have _any_ concern about your own safety (physical, legal, etc.) when making a report. Personally, I would have stopped right before "The Cleanup", and made a report. Which option would I choose from https://www.cisa.gov/report https://www.cisa.gov/report? None of them stand out, so I would have chosen the last option, to send an email.