I'm sorry to hear that :-(

Being a white hat is often a thankless job. You find something real, report it properly, and the response ranges from silence to suspicion. That's just how it is.

The tricky part is that if you do this for the broader community - and that's the right reason to do it - the reward is that the users are safer. That has to be enough on its own, because when isn't, the line between responsible disclosure and leverage gets uncomfortably thin.

Keep reporting. Not every project will respond the way they should, but the ones that do make it worth it :-)