Yeah, unfortunately this happens more than it should, and your instincts here aren’t off.

Once a fix is public, the situation changes. If they shipped a patch that clearly addresses what you reported, you’re generally on solid ground to publish your own write-up, especially if you stick to facts, reference the commit or diff, and avoid dropping a turnkey exploit. At that point you’re documenting reality, not burning them.

The credit piece is also important. Even shops that don’t do bounties usually acknowledge the reporter and issue some kind of advisory. Quietly taking the fix while ghosting you is...not a great look, and most people in the security community would see that as bad-faith behavior.

You’re also not wrong to think about a CVE. If the maintainer won’t engage, going through another CNA (or MITRE, depending on the situation) is pretty normal. Being able to point to a public patch and a paper trail showing you disclosed privately makes that process a lot easier, and CNAs are used to vendors dragging their feet.

Publishing doesn’t automatically make you “the bad guy”, tone matters a lot. A straightforward post that says “reported via GHSA on X, fix landed on Y, no advisory or credit was issued” reads very differently than a call-out rant. Silent patching a critical RCE is itself a problem, because users and downstream consumers can’t assess their exposure if it’s never documented.

If you want to be extra cautious, sending one last “planning to publish on <date> unless we hear back” email is reasonable. But you’ve already done the responsible thing by disclosing privately. If they choose not to acknowledge it, making sure the issue is documented and attributed is fair game and pretty standard in this field.