[xz0r]

I too reported a similar issue very recently to VRP and got the exact same response, except in the end there was a line

"If you think we've misunderstood or can provide a convincing attack vector, please do let us know!"

I think OP did not post this line in the blog; which makes Google look like they don't at all care.

[bobross]

No, it was the full email. Besides, I've tried to suggest a fix by prompting first time users but it's been ignored for a week.