While I do appreciate this disclosure, I'm not sure doing so a year later warrants much applause. While I agree this is a vulnerability that only effect a small subset of users (<1%), this actual number of users could be large depending on the size of their customer base (likely tens of thousands).