Yeah. "We let Twitter (via Kevin Rose) know about this before it went live but we think somebody saw the Test!" is a total numbnuts disclosure policy.
If one finds a vulnerability, follow the rfpolicy[1] or similar. Send an email to security@example.com, not Kevin Rose. (Seriously—Kevin Rose? What the hell does he have to do with Twitter's security response team?)