I'm one of the engineers at Bluesky that handles incoming security reports. We of course do take reported security issues very seriously. We have worked positively with a number of researchers.

The initial email in this case was received on a Friday afternoon, reviewed briefly for severity, and then acknowledged on the following Tuesday. There was a reply from another engineer on Wednesday to a reply by the reporter.

But we certainly could have followed-up better, and we could have been more clear. We're a very small team and the severity was deemed low, but even so we'll try to do better in the future for similar cases.

We do want to handle these kinds of reports better than most companies do. Creating a safe and secure system for users (which include our own families and friends) is something the team very genuinely cares deeply about.