Don't responsibly disclose, it's not worth the hassle anymore. Unless somewhere has a paid bug bounty program that has a good reputation I just use an anonymous email and send the bug to https://seclists.org/fulldisclosure/