You usually don't have to write headlines like "1.5M users compromised!" to get people to fix trivial web flaws. Also, before asking VC's and posting public Twitter messages and spending two days trying to track down a security contact, try mailing "security@" first; as you discovered, that sensible default generated an immediate response.

Edited out "not '96 anymore", the word "breathless", and my assessment of his effort to track down security@ as "hinky"; I wasn't happy with the tone of this comment in retrospect either.