Ten days ago, I reported a cross-site scripting bug on a
stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so far I didn't receive a response to either message. Am I too impatient or did the report get lost?
Since XSS flaws aren't terribly severe, I understand that fixing this one might not be a top priority among other security bugs. But since I also didn't get the usual "we received your report and we'll have a look" within the first few days, I figured something might have technically gone wrong.
(I submitted the bug via the contact form and included the words "security vulnerability", as instructed here. I would have gone through HackerOne, but didn't get access to the private beta program.)