"Hi
I would like to inform you about a critical security vulnerability on your site.
The vulnerability allows an attacker to reset the password of an account by simply knowing the targets email address.
Please reply with a signed S/MIME message and I will precisely explain the vulnerability to you.
Kind regards, ..."
May I suggest an email which establishes your credentials and gives a bit more details - without necessarily telling a customer service agent the full details.
For example:
> My name is Bob, I'm a security researcher at FooCorp. I've discovered a serious security vulnerability with your XYZ system. It is possible to reset customers' accounts without any authorisation. I've been able to replicate this on test account abc@123. I think this is caused by a misconfigured widget. Please can you forward this message on to your head of security. You can see my previous security work at http://....
Something like that may be more likely to get some positive attention.
I'd leave that out unless you're confident the company isn't going to screw you. Speaking from experience.
Sending a company proof that you've accessed a security hole (e.g. demonstrating it to them) can and has been prosecuted against has a hacking attempt and/or unauthorized access.
This is something every security researcher should know, and not necessarily pejorative against Nexmo in particular.
The parent was offering general advice for working with companies, and I was offering a general observation about that advice (namely, don't admit to technically-a-crime unless you know you're working with someone in good faith). Nothing personal, and it sounds like you guys have handled things professionally :-)
Edit: In particular and to clarify, my negative experience was not with your company.
It's bad. But it's still reasonable to not assume the worse. Email the CEO or try to reach some developer on LinkedIn or Twitter.