OP might not be wrong, but let's at least follow SOP for disclosing security failures (30 days pre-disclosure)