The deadline for fixing the vulnerability - how long can I publish?

Question

Payment systems

Given: a serious vulnerability in a popular company. Vulnerability, if desired, can harm financially (and very strongly) and reputationally (money of citizens, clients of this company).
The vulnerability was reported to this company, as expected, both by phone and by letter, they painted the whole scheme. Received a response - took note.
2 weeks have passed. We decided to ask - how are things, closed or not. They said that they would not report the result of closing or not closing. And also whether it exists at the moment - they also do not want to report.
Trying to reproduce it is, as it were, a criminal offense, but you don’t want to spend your money on checks.
Question: what are the terms in general according to our Criminal Code of the Russian Federation to publish it on an information resource in order to stimulate its elimination? How much time do you need to wait?
I don’t want to expose myself, if suddenly everyone runs to check it. It will be a hit! They are not interested in this either.

Answer 1

чисто юридически = любая публикация вами будет оценена как подстрекательство вне зависимости от срока

Answer 2

Забить
Не работать там, где живешь без прикрытия тов майора
Не работать если компания не имеет багбаунти

Answer 3

опубликуйте предварительную информацию без раскрытия деталей уязвимости - классификацию, потенциальные риски для клиентов, timeline взаимодействия.

Answer 4

В УК РФ про это всё есть, наказание приличное, если они в суд пойдут.
Просто забейте и всё.