Something that helps, in my experience, is what Colin Percival teaches: use the phrasing of "coordinated disclosure" , rather than "responsible disclosure". This helps the company understand that the disclosure and the bug are both happening, and the company can choose to coordinate or not. Send a link that explains your position, and how the company can respond. Here's mine and feel free to use it...

https://github.com/joelparkerhenderson/coordinated-disclosur...