[ZoFreX]

I'm not 100% on the rules of responsible disclosure, but isn't giving a company more than a year to fix an incredibly basic error more than enough time? The longer you wait the higher the chances a black hat will come along, why should their customers burn due to the company's apathy?

[alttab]

Agreed. At that point I'd post it on an anonymous blog through a proxy just to protect yourself in the case they want to be assholes.