Etsy has been one of the best companies I’ve reported holes to.
Now this is how you do security:
They had detected my requests and pushed a patch Saturday morning before I could email them. This was by far the fastest response time by any company I’ve reported to. Not only that, he told me he had messaged the account I created for the sole purpose of testing.