[judk]

How about responsibly disclosing to the victims/users before going public?

[anon1385]

I don't see how that would be possible unless Slack has a full list of their customers available somewhere.

Note that elsewhere in this thread you can see that it was reported to Slack, but they responded saying it wasn't a bug.