Ask HN: How to communicate security issues to the community of software project

Some project recently had an issue that let remote, unauthenticated users read any file from the server it ran on as long as user permissions did not interfere.

The fix to that issue was implemented in a reasonable time frame but the release was not specially advertised. Instead the mention was inside the body of a generic "softwareproject Version 1.2.3 released" post.

When I posted some pretty angry comments about this, I was met with a mixture of understandable personal defense ("we do this in our free time, don't be so negative") and ignorance ("the users should take care about sandboxing and permissions themselves").

The software is widely deployed on government systems and companies all over the world. Randomly sampling Google results gave me more vulnerable servers than not.

I feel that the project misses the severity of this issue and neglects the security of its users. I want to make sure they understand this and how to prevent similar problems in communication in the future.

Looking around for some best practices on this, I came up blank.

How could the project have communicated the issue better? What are the commonly exercised best practices. Are there industry standards?

Thanks!