Context: recently I found a vulnerability in a webapp for a big company. They have a full policy on responsible disclosure which I followed to avoid legal issues.
The company commits itself to answering within a time period (in this case two weeks). However that period has ended and I haven't received any response, not even an acknowledgement that they know the problem exists.
How should I handle this?
There are other questions like this one, but often about disclosure to a company without a policy.