This risk is only exploitable by authenticated users, right? With the worst impact from it being service degradation/denial of service, operators should be able to fairly quickly identify and revoke the malicious account. Given that, I think continuing to work this one in public would be a reasonable choice.
This risk is only exploitable by authenticated users, right? With the worst impact from it being service degradation/denial of service, operators should be able to fairly quickly identify and revoke the malicious account. Given that, I think continuing to work this one in public would be a reasonable choice.