I'm a bit conflicted about what responsible disclosure should be, but in many cases it seems like …

I'm a bit conflicted about what responsible disclosure should be, but in many cases it seems like these conditions hold: 1) the hack is straightforward to do; 2) it can do a lot of damage (get PII or other confidential info in most cases); 3) downtime of the service wouldn't hurt anyone, especially if we compare it to the risk of the damage. But, instead of insisting on the immediate shutting down of the affected service, we give companies weeks or months to fix the issue while notifying no one in the process and continuing with business as usual. I've submitted 3 very easy exploits to 3 different companies the past year and, thankfully, they fixed them in about a week every time. Yet, the exploits were trivial (as I'm not good enough to find the hard ones, I admit). Mostly IDORs, like changing id=123456 to id=1 all the way up to id=123455 and seeing a lot medical data that doesn't belong to me. All 3 cases were medical labs because I had to have some tests done and wanted to see how secure my data was. …