Your two messages contradict each other- >So, we've made it pretty clear from the start >I agree. The message should be more clear. It seems like a bit of ba

Your two messages contradict each other- >So, we've made it pretty clear from the start >I agree. The message should be more clear. It seems like a bit of backpedalling here. Rather than try to blame the author for not understanding or quoting the announcement that most people wouldn't have read anyways I think you should just commit to fixing the underlying problem (first the message that's passed, then the actual feature itself) and thank the author for drawing attention to it and educating your users on the security issue at hand.