The way I see it, as long as you do your job to notify them of security problems with their code, then the ball is in their court and it's out of your hands. If they choose to ignore it, and it ends up being a disaster, it's their fault as long as you can show you did your job in notifying them properly.
Re:Ask HN: What's your working day like?
by toomuchtodo on Monday May 08, 2017 @07:38PM
(#14296564)
Enjoy dat paycheck. You're earning it.
To make things worse, the dev lead's boss always defers to his team's knowledge about the issues, so getting certain security issues fixed can require getting upper management involved.