Lithium communities at other companies (Checkpoint, Cisco, Spotify, Sprint, Dell) get similar grades. It seems like the "AppSec" vulnerability and its response belong to Lithium, not (ISC)².
(ISC)²'s risk is most likely reputational damage from a supplier breach. Their mitigation is to minimize non-public information shared with suppliers and to include a "supplier breach" scenario in their Incident Response playbook so that they are prepared to quickly respond.
My guess/hope is that (ISC)² is only sharing first/last name, email and a list of certificates held (to be turned into badges). If true, @Chuxing is on the right track regarding the severity and appropriate response.
I do suggest that if one believes there to exploit potential, the community is not the best place to start the conversation. Instead, one ought to follow responsible disclosure practices. That is, privately report the issue and a reasonable deadline to the company before you go public.
)
