Ask HN: Security vulnerability in deployment – what to do?

Around 1.5 months ago, I found a security vulnerability in a web page I developed, which was deployed by another person: A GET to an easily-guessable URL gives away a file containing a password with which one can login and modify content.

I reported that vulnerability immediately to the person deploying it and he answered he would look into it and reply. He did not. I sent two followup emails regarding the issue and did not get any reply.

What should I do to get the issue fixed? My first idea would be to notify the customer, but I am certain the customer can not fix it.