[IIsi50MHz]

> and they offer opt-in (not automatic) refund.

Please consider whether they can authenticate a user based on an HN comment and HN profile. The request for the user contact the company directly makes sense.

> Also controversial, like, if it's a bug, why isn't the refund automatic in the first place.

Have they known about the bug before? For how long? Perhaps it's not an automatic refund because they need to confirm the underlying issue, figure out which users are affected, and only then get management to to sign off on it.