How should a startup or a company in this situation handle it properly ? Should they come out clean to their users ?