They aren't demanding anything of you. The alternative is immediate disclosure of bugs, not indefinite embargo of bugs.