I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not something that is especially easy to exploit, but it is certainly possible. It's somewhat convoluted for an app developer to fix, but I have some proof-of-concept code that helps resolve the problem, at least in some scenarios.

I filed a security bug report with the platform vendor. After initially agreeing that it is a security bug ("Moderate" severity), they have now come back and stated "this is currently working as intended" and "we have determined there isn't a security impact". This was 10 days after filing the report, and their guidelines request a 90-day responsible disclosure timetable.

Given their "working as intended"/"isn't a security impact" response, am I under any obligation to continue to sit on this for the remaining 80 days? Or can I start advising affected developers on how to work around this bug?