Inform them, if the issue is not fixed and users are at risk, go public.