I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a large number of people. Thankfully, the IT team at the lab in question were very receptive, and quickly found a way to disable the remote interface.
However, this got me thinking - what if they hadn't been so receptive, and had ignored me? What if they'd simply decided not to fix the issue? Obviously I wouldn't want to jump straight to full disclosure, since that would almost certainly result in disaster. But on the other hand, the public has a right to know about the potential danger they were/are in, and ensuring that a fix is put in place is critical.
What's the best way to handle security issues where a potential loss of life is involved, but the vendor is uncooperative?