I reported a vulnerability to Northwestern once, and I did not feel it was received very well. There were a few interesting emails back, but most of the emails could be condensed to just "You didn't handle this correctly" and vague emails that felt as if the person was talking …