If you read between the lines on the JetBrains and Rapid7 story, you'll see that JetBrains decided to cut Rapid7 out of the loop on Feb 23, but told Rapid7 that they're "still investigating" on Mar 1.

However you feel about PoCs, technical details, disclosure, etc., it's super inappropriate to lie to researchers who disclosed this to you responsibly about what your plans are.

Refs:

• https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
• https://blog.jetbrains.com/teamcity/2024/03/our-approach-addressing-recently-discovered-vulnerabilities-in-teamcity-on-premises/