They stopped communicating with Rapid7. When you stop, you know, coordinating with the researchers they are free to do what they want. Rapid7 likely gave them t

They stopped communicating with Rapid7. When you stop, you know, coordinating with the researchers they are free to do what they want. Rapid7 likely gave them their entire process, set expectations and coordinated with JetBrains up front. This is sort of an “ethical standard” most firms and security researchers follow. The timeline’s they use and the exact process they follow varies. The key goal is to keep the vulnerabilities public and properly credit the researchers. Coordinated disclosure is an olive branch, so you know exactly what to expect and how to behave. It is generally very reasonable. If you break the terms or spirit of this process the researchers have no reason or real recourse but to release their info whenever they want and feel is appropriate. Don’t break the faith, the researchers are essentially doing you a favor by following this policy. It really is not hard to communicate and act in good faith on both sides. I have coordinated the release of dozens of vulnerabilities. I have definitely disclosed them after companies ghosted us or threatened us hoping to make the issue go away. JetBrains got cute and cut the researchers out of the loop. Now future researchers will likely treat JetBrains as a bad faith actor and proceed accordingly.