It's only worth reporting "responsibly" if waiting might prevent users from being hurt. The way that concept has been manipulated into implying that the companies are owed an early warning is crap. The author doesn't owe CircleCI anything.

This comment highlights the problem with calling disclosure 'responsible', because the word is used subjectively.

What you as a commenter, or a company (usually prefers to quietly fix this), or the wider user base (usually prefers a 'heads up' immediately), all have different opinions about what they see as responsible.

Also, it doesn't seem fair to dismiss this disclosure as a 'hit piece' unless it is factually incorrect.