I'd anonymously email and tell them they had 7 days to acknowledge having received your message. After that they get a month or maybe two to fix it. Then public disclosure. All anonymous over Tor, because you can always attach your name later but you cannot remove it if you already gave it.

Or if they don't respond at all, immediate public disclosure. If that's how they want to play the game, then let's play.

Be wary if they ask for your name straight away because companies have been known to sue.