Comment by theOnliest

But this doesn't really need to be responsibly disclosed: it's not something someone can use to get into your machine, but rather a way you could accidentally broadcast your credentials somewhere unexpected.

Announcing on Twitter seems more like "hey be careful, make sure your password field is focused."