I'm sure that a core developer disclosing a vulnerability in Nix on their for-profit company's Twitter feed instead of coordinating the disclosure through official channels isn't a conflict of interest again, it's just a community service!