What if Curebit had an important demo/presentation that was botched as a result of this? I think the response should be tailored to provide them with a learning opportunity rather than to hurt their startup. A private naming/shaming like betageek suggested would probably do the trick.