The tone argument is a distraction, but thank you for pointing out the real problem here: this is an irresponsible way to disclose an issue that hurts people wh

The tone argument is a distraction, but thank you for pointing out the real problem here: this is an irresponsible way to disclose an issue that hurts people whose only mistake was using MongoDB in production. It's not hard to find out how to report security issues to 10gen: http://docs.mongodb.org/manual/administration/vulnerability-notification/ http://docs.mongodb.org/manual/administration/vulnerability-... and the terms they ask for look reasonable to me.