> but I feel like if I don't do anything someone malicious will discover the issue and cause harm to users of the website. They certainly will. Usually respons

> but I feel like if I don't do anything someone malicious will discover the issue and cause harm to users of the website. They certainly will. Usually responsible disclosure is defined as some form of contacting the party involved, working out some window of time that you both agree on during which they can fix the bug (~30 days say), then disclosing details of the vulnerability. This is like a very polite and necessary threat. If you care I would contact them again and let them know you plan to make the vulnerability public, and ask how much time they need to fix it.