the vulnerability is there whether disclosed or not. if you find it, someone else has too. sitting on it is the irresponsible thing.