I'll add to disclose it anonymously tied to a pseudonym and/or public key. You can give them data and time to fix it with assurances it will be more public after a reasonable period of time. Thanks to anonymity, they're not going to do shit like in the article.