You found a vulnerability in a vendor's product at work. You reach out to your TAM and they tell you that they won't accept your findings through any path but their bug bounty path. The bug bounty rules explicitly declare your _good findings_ out-of-scope of the program. There is an executed NDA in place.

You've already argued with the vendor, they're not budging.

What do you do?