It is not your lesson to learn. You tried to be helpful, in a way that you had no idea was verboten. Unlearning being helpful is not a good outcome of this.

It being a potentially massive security issue, taking care to make sure it is safe to release the information is definitely something that should happen, but it appears that you did this:

> My contact had told me there was no embargo, and her contact had told her the same thing.

I'm pretty sure I'd have been more cautious given that the CVE details were not minimal, as this usually implies that releasing the details is expected to cause early exploitation¹, and wouldn't have discussed it as publicly as on HN, but don't kick yourself too much for having done so. You did not break the chain, someone before you, maybe several links before you, did by telling others without giving them information about the need for an embargo.

--------

[1] Perhaps that is a lesson to learn, rather than the not being helpful one? Even then that is a small correction to your level of caution, the big lesson (“FFS be careful, things are embargoed for a reason”) is still for those before you in the chain.