> disclosure timelines only make sense if the public is at risk The post says that fraudulent charges can be made without a password or credit card number by u

> disclosure timelines only make sense if the public is at risk The post says that fraudulent charges can be made without a password or credit card number by using this exploit. I would bet that you can access account info as well which means there is some PII leaking. I would consider PII + fraudulent transactions to be a step above gogo losing oney.