Do they know any personal information about you from your exchanges so far? If so, be careful because you might be liable if you disclose any vulnerabilities.
Thank you for the input. They do. I'm in the EU, are you aware of any issues that I may face if I choose to disclose it?
This sounds like the kind of thing the EU has laws for, where a company is legally mandated to fix vulnerabilities that may reveal personally identifiable information if made aware of these. Worth asking someone who's more of a lawyer than I am about that (since I am definitely not a lawyer).