A cybersecurity firm, “Red Access,” contacted us less than 24 hours before going to the media with vague claims about Replit. This is not how responsible security research works. The standard practice in terms of disclosure policies, as followed by CISA, CERT/CC, and most major firms, is to share findings privately and allow a defined window for remediation before public disclosure. A 24-hour countdown to a press cycle is not that. From the limited information they shared, their core claim…