Something that helps, in my experience, is what Colin Percival teaches: use the phrasing of "coordinated disclosure" , rather than "responsible disclosure". Th

Something that helps, in my experience, is what Colin Percival teaches: use the phrasing of "coordinated disclosure" , rather than "responsible disclosure". This helps company staff understand that the disclosure and the bug are both happening, and the company can choose to coordinate or not, and there's no need to debate what's responsible or not. Send a link that explains your position, and how the company can respond. Here's mine and feel free to use it... https://github.com/joelparkerhenderson/coordinated-disclosure https://github.com/joelparkerhenderson/coordinated-disclosur...