Where's the attempt to submit a patch to fix the problem before disclosing?

As danbee said, it's the only way to do it. You should be able to set up an app-specific password via Apple's site first and provide that instead.