[sova]

Zendesk pay the man. He disclosed only after you waved it off as a nonthreat. Pay. The. Man.

[Aachen]

Not even really 'disclosing' but just reporting to affected parties that they've got a problem

That this hurts Zendesk is too bad, it's still the morally correct thing to do and Zendesk probably understands that, too