I agree. I sent them a message about something in their blog. They edited the blog, but didn't thank me or anything...

I have sent them an email pointing out two bugs with google.com/ig. So far no response.

Onced I send them bug report about their jabber server and recived two requests for more information ;]
And it was the only time they replayed me anything...

they provide a good response

Google has a relatively good reputation. Better than M$ at least.

I send them one in japenese from http://yahooanswers.blogspot.com/ but I don't thing they understood

If you just e-mail the security flaw to them you have know way of knowing if it will be acted on, because even if they get your e-mail they will not reply to it. The most _responsible_ thing to do in this case is make a public disclosure, IMO.

Thank god they fixed it...