Choc Factory patches zero day Google for Work hack hole

It's a tricky thing to judge.

It's not safe to assume that the white hat hacker is the only person to discover the flaw, a black hat could have discovered the flaw since, or more concerning, before.

No, if you can't agree on a deadline (or equivalent criteria; sometimes there might be a dependence on a third party, like submitting a patched version to the Apple App Store then having to wait for Apple to approve it so users can actually install it) - release it straight away, because they're not engaging properly.

Anything other than agreeing to expedite a fix with a reasonable timescale sounds too much to me as if they're planning to hide it instead - so if you don't disclose ASAP, you'll probably find their lawyers trying to bury you instead. Every day you delay disclosure is another day they might be using to get a court injunction to gag you about it, as Ross Anderson's guys at Cambridge University have encountered in the past.