I mean, who honestly even wants to 'responsibly' disclose anything like this if they live in the US? The risks of assault rifle toting FBI agents coming for coffee at six AM outweighs any benefit I can think of.
Not working out so great for the St. Louis Post-Dispatch reporter who "hacked" the website by looking at it.
https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post...