Ask HN: How do I go about responsibly disclosing security vulnerabilities?

I'm dabbling in pen testing and recently discovered a major security hole in a service. The data exposed via this information is very sensitive information that amounts to me being able to track large groups of people's locations and movements. The company responded to my first round of testing positively. They've left a pretty glaring error unfixed though and I suspect a lot of it has to do with the fact that the changes required to fix it will break every version of their application available. I'm concerned because they have released three new versions of their app since I disclosed the vulnerability to them and all of them enable the data leak error I found. Each day a few hundred data points get added to the system. Phone numbers. Names. Location etc. I'm sending the second mail now. But I would like to push them by warning of a public disclosure that such an error exists (without disclosing how to exploit the bug).

It feels like threatening, and I'm not sure what the legal implications are. Overall it feels unethical to be sitting with this knowledge and not disclosing it if the company doesn't get it done.

That said, I informed them only a week ago. Which really puts me at crossroads. Usually the time given is one month. But with the data being this critical, I don't know if one month is acceptable.

What should I do?