“ The response might've been different if the author had already given a patch”

For a security related issue? Not sure that is a wise decision.