I was waiting for a "I disclosed the vulnerability and this is how they reacted" story arc but there wasn't one. Pretty disappointed OP went this route. The golden rule is to always disclose the issue and wait for them to fix it before you publish. The only exception to this rule is if the company isn't acknowledging, responding, or communicating in any way. In that case you'd wait around three months, send a follow-up email warning them you'll publicly disclose the vulnerability, wait another three months, and then publish it.