> and doing a public write-up once the issue is fixed

I'd also check with UK laws, as even that might be close to gray-ish territory if they're willing to go after you. Litigious companies are a pain to work with. Especially if they seem to be looking for no bad PR. Worth a few hours of research, maybe reach out to a non-profit and see if they can help?