So I took everyone's advice and have done the following. 1) I mailed the company again saying that they have not yet addressed the issue. And that the vulnerab

So I took everyone's advice and have done the following. 1) I mailed the company again saying that they have not yet addressed the issue. And that the vulnerability is now critical given how much info they are adding per day. Expressed that I would like to know if a patch is in the works. 2) Contacted several people in the IT security and audit business and asked what the standard procedure was. The response from our CERT was that for a vulnerability of this nature they need to respond with intention and details of fixing within 24 hours else I'm free to send one more email expressing intention to disclose vulnerability to public. Disclosure of vulnerability will not include how to exploit, proof of concepts, or any personally identifiable information. 3) if they say they need some time, and they say how much ( or I have to ask) I have to allow them that. 4) if things get ugly, CERT will take over upon my request Yey. Thanks to all for the advice