I understand your point of view, but this is pretty much all on JBs part in my opinion. They say as much in a recent blog post. >At this point, we made a decis

I understand your point of view, but this is pretty much all on JBs part in my opinion. They say as much in a recent blog post. >At this point, we made a decision not to make a coordinated disclosure with Rapid7 >We published a blog post about the release. This blog post intentionally didn’t mention the security issues in detail These points would have triggered Rapid7s silent patching policy, which would have sped up the entire timeline and lead to the current state of affairs. I don't consider that to be spiteful (the policy is out in the open, JB knew what they were doing and knew the consequences of not coordinating any longer), but that's just me.