[kevin_thibedeau]

> you have to give them the chance to patch it themselves

No you don't. If they're just going to bury the truth and hang their users out to dry then the responsible route is to bypass them.