If a bug in my code put my customers' data at risk, I would fix the vulnerability; make sure I fully understood its scope; make sure there were no other similar bugs; write a blog post alerting the world to the problem and providing any mitigation strategies; and email all my customers to make sure they saw the blog post.