Full Disclosure. That's what happens when companies aren't interested in hearing about their security vulnerabilities. https://nmap.org/mailman/listinfo/fulldisclosure
Even looking for vulnerability's in software running on servers that aren't controlled by you without permission is very legally sketchy.
Whether or not you should do so or not for the good of the internet is a different argument, but you should be aware of the potential implications.
- Your website has no security page and setting this up is such a low priority that you have no ETA on when /security might exist.
- You instead use a third party service to manage your security disclosures. Yet, you don't link to this site from your website.
- A researcher tries to contact you again and again. He gets no reasonable response so after several months he posts on Hacker News.
The Hacker News post finally gets a response, yet you expect us to believe that you care about security???