That really comes with the territory of being an ethical security researcher, particularly when the recipient is welcoming of the disclosure. I'd also argue mo

That really comes with the territory of being an ethical security researcher, particularly when the recipient is welcoming of the disclosure. I'd also argue more so when it is open source. Otherwise, why not just drop them as zero days? The disclosure methodology is based on the researcher holding the cards and putting pressure on the recipient to resolve the issue in a timely manner. What do you feel is the alternative?